import type { AwsCredentials } from "../types/credentials.js";
/**
 * Interface for AWS credential and client management.
 *
 * CLI provides: its full AwsContext (SSO, OIDC, credential caching).
 * Worker provides: SimpleAwsProvider (pre-assumed OIDC credentials).
 *
 * deploy-core services use this interface — they never care HOW
 * credentials were obtained.
 */
export interface AwsProvider {
    /** Get a configured AWS SDK v3 client instance. */
    getClient<T>(ClientClass: AwsSdkClientConstructor<T>): T;
    /** AWS region for this context. */
    getRegion(): string;
    /** AWS account ID — always available (callers resolve before calling deploy-core). */
    getAccountId(): string;
    /** Raw credentials for subprocess environments (CDK). */
    getCredentials(): AwsProviderCredentials | undefined;
    /** Export credentials to process.env for spawned subprocesses. */
    exportToEnv(): void;
    /**
     * Assume an IAM role and return credentials for the assumed session.
     * Used by organisation cascade to assume roles in member accounts.
     */
    assumeRole?(roleArn: string, sessionName: string): Promise<AwsProviderCredentials>;
    /**
     * Derive a provider bound to already-assumed credentials — the cascade's
     * per-member-account session. Concrete provider construction belongs to
     * the composition root, never mid-orchestration: routing derivation
     * through the injected provider keeps the AWS seam substitutable (a test
     * double here is the only thing standing between the cascade unit suite
     * and live IAM/S3 traffic). The derived provider must carry no
     * scoped-session minter — an assumed cascade session never re-scopes
     * itself.
     */
    scopedProvider?(scope: AwsCredentials): AwsProvider;
    /**
     * Assume the SAME identity but with an inline session policy that scopes it
     * down to exactly the SSM / Secrets Manager parameters a build needs to read
     * (least privilege). Returns a provider bound to the scoped session. When a
     * provider has no way to re-mint a narrowed session — no SSO/OIDC role to
     * re-assume (CLI), or no re-mint hook injected (worker) — this is absent and
     * the caller falls back to the unscoped provider — see `resolveBuildSecrets`.
     */
    assumeScopedBuildSecretSession?(inlinePolicy: string, sessionName: string): Promise<AwsProvider>;
}
export interface AwsProviderCredentials {
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
}
/**
 * Constructor type for AWS SDK v3 clients.
 * Matches the signature of all @aws-sdk/client-* default exports.
 */
export type AwsSdkClientConstructor<T> = new (config: {
    region?: string;
    credentials?: AwsProviderCredentials;
}) => T;