/**
 * SSO Session configuration for ~/.aws/config
 */
export interface SSOSessionConfig {
    sessionName: string;
    startUrl: string;
    region: string;
    registrationScopes: string;
}
/**
 * AWS Account information from SSO
 */
export interface SSOAccount {
    accountId: string;
    accountName: string;
    emailAddress?: string;
}
/**
 * AWS Role information from SSO
 */
export interface SSORole {
    roleName: string;
    accountId: string;
}
/**
 * Combined account with roles
 */
export interface AccountWithRoles {
    account: SSOAccount;
    roles: SSORole[];
}
/**
 * Profile to be created
 */
export interface ProfileConfig {
    name: string;
    accountId: string;
    roleName: string;
}
/**
 * Padua SSO defaults
 */
export declare const PADUA_SSO_DEFAULTS: {
    sessionName: string;
    startUrl: string;
    region: string;
    registrationScopes: string;
};
/**
 * Padua CodeArtifact defaults (hardcoded)
 */
export declare const PADUA_CODEARTIFACT_DEFAULTS: {
    domain: string;
    domainOwner: string;
    repository: string;
};
/**
 * Padua ECR defaults (hardcoded)
 */
export declare const PADUA_ECR_DEFAULTS: {
    accountId: string;
    region: string;
};
/**
 * Get cached SSO access token if valid
 */
export declare function getCachedAccessToken(startUrl: string): string | null;
/**
 * Register OIDC client with SSO
 */
export declare function registerSSOClient(startUrl: string, region: string): Promise<{
    clientId: string;
    clientSecret: string;
}>;
/**
 * Start device authorization flow
 */
export declare function startDeviceAuthorization(clientId: string, clientSecret: string, startUrl: string, region: string): Promise<{
    deviceCode: string;
    userCode: string;
    verificationUri: string;
    expiresIn: number;
}>;
/**
 * Poll for access token after user authorization
 */
export declare function pollForToken(clientId: string, clientSecret: string, deviceCode: string, region: string, expiresIn: number): Promise<string>;
/**
 * Authenticate with SSO and get access token
 * Uses cached token if valid, otherwise initiates device authorization flow
 */
export declare function authenticateSSO(startUrl?: string, region?: string, onBrowserOpen?: (url: string, userCode: string) => void): Promise<string>;
/**
 * List all AWS accounts the user has access to via SSO
 */
export declare function listSSOAccounts(accessToken: string, region?: string): Promise<SSOAccount[]>;
/**
 * List all roles for a specific account
 */
export declare function listAccountRoles(accessToken: string, accountId: string, region?: string): Promise<SSORole[]>;
/**
 * Discover all accounts and roles the user has access to
 */
export declare function discoverAccountsAndRoles(accessToken: string, region?: string): Promise<AccountWithRoles[]>;
/**
 * Generate profile name from account name and optional role name.
 * All profiles use the 'paduafg' prefix for namespace identification.
 *
 * Naming strategy:
 * - Management account (single role): "paduafg"
 * - Other accounts (single role): "paduafg-{account}"
 * - Any account (2+ roles selected): "paduafg-{account}-{role}"
 */
export declare function generateProfileName(accountName: string, roleName?: string, multiRole?: boolean): string;
/**
 * Build profile configurations from discovered accounts and selected roles.
 * When multiple roles are selected, each account gets a profile per role
 * with a role suffix in the profile name to prevent collisions.
 */
export declare function buildProfileConfigs(accountsWithRoles: AccountWithRoles[], selectedRoles?: string[]): ProfileConfig[];
//# sourceMappingURL=sso-discovery.d.ts.map