/**
 * AWS credential resolution for the Bedrock provider.
 *
 * Chain (first hit wins):
 *  1. Static credentials from the environment
 *     (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` [+ `AWS_SESSION_TOKEN`]).
 *  2. Web identity (`AWS_WEB_IDENTITY_TOKEN_FILE` + `AWS_ROLE_ARN`).
 *  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO/roles):
 *      - static keys, SSO, `credential_process`, or `role_arn` role chaining
 *        (`source_profile` recursion, `web_identity_token_file`, `credential_source`).
 *  4. ECS/container credentials from `AWS_CONTAINER_CREDENTIALS_*`.
 *  5. EC2 IMDSv2 when metadata is enabled.
 *
 * Resolved credentials are cached process-wide per profile and refreshed
 * 60 s before `Expiration` to absorb clock skew.
 */
import type { FetchImpl } from "../types.js";
import { type AwsCredentials } from "./aws-sigv4.js";
export interface ResolvedCredentials extends AwsCredentials {
    /** Absolute expiration timestamp in ms. `undefined` for non-expiring static creds. */
    expiresAt?: number;
}
export interface CredentialResolveOptions {
    /** Named profile from `~/.aws/credentials` / `~/.aws/config`. */
    profile?: string;
    /** Falls back to env (`AWS_REGION` / `AWS_DEFAULT_REGION`) and finally `us-east-1`. */
    region?: string;
    signal?: AbortSignal;
    fetch?: FetchImpl;
}
export declare function resolveAwsCredentials(opts?: CredentialResolveOptions): Promise<ResolvedCredentials>;
/** POSIX-shell-style tokenizer used by the AWS CLI for `credential_process`.
 *
 * Outside quotes a backslash escapes the next character. Inside single quotes
 * everything is literal (no escapes, cannot contain `'`). Inside double quotes
 * a backslash only escapes `$`, `` ` ``, `"`, and `\` — every other backslash
 * is preserved verbatim, which is what makes Windows paths like
 * `"C:\Program Files\tool\auth.exe"` survive tokenization. */
export declare function tokenizeCredentialProcessCommand(cmd: string): string[];
/** Test/diagnostic helper — drops cached credentials. */
export declare function clearAwsCredentialCache(): void;
/**
 * Drop the cache entry for one profile/region. Called by the Bedrock provider on
 * 401/403 responses so stale credentials are re-resolved instead of served until restart.
 */
export declare function invalidateAwsCredentialCache(opts?: {
    profile?: string;
    region?: string;
}): void;