import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Redacted from "effect/Redacted";
import { CredentialsStore } from "../Auth/Credentials.ts";
export declare const AWS_AUTH_PROVIDER_NAME = "AWS";
/** Default endpoint of a local AWS emulator (floci / LocalStack). */
export declare const DEFAULT_LOCAL_ENDPOINT = "http://localhost:4566";
/**
 * Dummy account stamped on every floci / `{ method: "local" }` environment.
 * A custom `AWS_ENDPOINT_URL` on env/sso credentials does NOT use this —
 * those keep the real account from STS / `AWS_ACCOUNT_ID`.
 */
export declare const LOCAL_ACCOUNT_ID = "000000000000";
export type AwsAuthConfig = {
    method: "sso";
    ssoProfile: string;
} | {
    method: "stored";
} | {
    method: "env";
} | {
    /**
     * Local AWS emulator (floci, LocalStack, or any endpoint-compatible
     * emulator). Resolves dummy credentials and points every AWS call at
     * the configured endpoint — no AWS account required.
     */
    method: "local";
    /** @default "http://localhost:4566" */
    endpoint?: string;
    /** @default "us-east-1" */
    region?: string;
    /** @default "000000000000" */
    accountId?: string;
    /**
     * Ensure the floci container is running (via `@alchemy.run/floci`'s
     * `ensureFloci`) when nothing is listening on the endpoint. Defaults to
     * true for the default endpoint only.
     * @default endpoint === "http://localhost:4566"
     */
    autoStart?: boolean;
};
export interface AwsStoredCredentials {
    accountId: string;
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
    region: string;
}
export interface AwsResolvedCredentials {
    accountId: string;
    credentials: Effect.Effect<{
        accessKeyId: Redacted.Redacted<string>;
        secretAccessKey: Redacted.Redacted<string>;
        sessionToken: Redacted.Redacted<string> | undefined;
        region: string;
    }>;
    region: string;
    /**
     * Custom AWS endpoint (local emulator). Flows into
     * `AWSEnvironment.endpoint`, which `Endpoint.fromEnvironment` applies to
     * every AWS SDK call.
     */
    endpoint?: string;
    source: {
        type: AwsAuthConfig["method"];
        details?: string;
    };
}
/**
 * An explicitly-set `AWS_REGION` env var wins over the region recorded in an
 * SSO profile (`~/.aws/config`) or in stored credentials. `AWS_DEFAULT_REGION`
 * deliberately does NOT override — it is a *default* for when no region is
 * configured anywhere, and the profile's region is explicit configuration.
 */
export declare const applyEnvRegionOverride: <C extends {
    region: string;
}>(creds: C) => Effect.Effect<C>;
/**
 * Layer that registers the AWS {@link AuthProvider} into the
 * {@link AuthProviders} registry when built. Include this in the AWS
 * `providers()` layer so `alchemy login` can discover it.
 */
export declare const AwsAuth: Layer.Layer<never, never, import("../index.ts").AuthProviders | CredentialsStore>;
//# sourceMappingURL=AuthProvider.d.ts.map