import type { AwsCredentials, ScopedBuildSecretSessionMinter } from "../types/credentials.js";
import type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./AwsProvider.js";
/**
 * Minimal AWS provider for pre-assumed credentials.
 *
 * Used by the webapp worker, which assumes an OIDC role before
 * calling deploy-core. No SSO, no credential discovery, no caching.
 */
export declare class SimpleAwsProvider implements AwsProvider {
    private readonly credentials;
    private readonly region;
    private readonly accountId;
    private readonly clientCache;
    /**
     * Present only when a re-mint hook is injected (the worker). Absent for a bare
     * provider — including the scoped child this very method returns, so a scoped
     * session cannot re-scope itself. deploy-core's `resolveBuildSecrets` reads the
     * field's presence to decide whether to narrow the build-secret read.
     */
    assumeScopedBuildSecretSession?: AwsProvider["assumeScopedBuildSecretSession"];
    constructor(awsCredentials: AwsCredentials, scopedSessionMinter?: ScopedBuildSecretSessionMinter);
    getClient<T>(ClientClass: AwsSdkClientConstructor<T>): T;
    getRegion(): string;
    getAccountId(): string;
    getCredentials(): AwsProviderCredentials;
    exportToEnv(): void;
    assumeRole(roleArn: string, sessionName: string): Promise<AwsProviderCredentials>;
    scopedProvider(scope: AwsCredentials): AwsProvider;
}