/**
 * Cloud IAM Session Broker
 *
 * Allows agents to request time-limited, scoped credentials instead of
 * long-lived broad access. This is "the right to act" paradigm - agents
 * must earn access per operation through RecourseOS evaluation.
 *
 * Flow:
 * 1. Agent requests credentials for a specific operation
 * 2. RecourseOS evaluates the intent
 * 3. If approved, broker issues scoped STS credentials
 * 4. Credentials auto-expire (default: 15 minutes)
 *
 * Supported Clouds:
 * - AWS (via STS AssumeRole with session policy)
 * - GCP (via Service Account impersonation) - planned
 * - Azure (via Managed Identity) - planned
 */
export interface SessionRequest {
    intent: {
        type: 'shell';
        command: string;
    } | {
        type: 'mcp';
        tool: string;
        arguments: Record<string, unknown>;
    } | {
        type: 'terraform';
        planJson: object;
    };
    cloud: 'aws' | 'gcp' | 'azure';
    roleArn?: string;
    durationSeconds?: number;
    sessionName?: string;
    actor?: string;
    environment?: string;
}
export interface SessionResponse {
    granted: boolean;
    riskAssessment: 'allow' | 'warn' | 'escalate' | 'block';
    reason: string;
    attestation?: {
        attestation_uri: string;
        key_id: string;
    };
    credentials?: {
        accessKeyId: string;
        secretAccessKey: string;
        sessionToken: string;
        expiration: string;
    };
    session?: {
        sessionId: string;
        roleArn: string;
        expiresAt: string;
        scopedPermissions: string[];
    };
}
export interface BrokerConfig {
    brokerRoleArn: string;
    allowedRiskLevels: ('allow' | 'warn' | 'escalate' | 'block')[];
    defaultDurationSeconds: number;
    maxDurationSeconds: number;
    attestation: boolean;
    region?: string;
}
/**
 * Cloud IAM Session Broker
 */
export declare class SessionBroker {
    private sts;
    private config;
    private attestationService;
    constructor(config: BrokerConfig);
    /**
     * Initialize the broker
     */
    initialize(): Promise<void>;
    /**
     * Request a scoped session
     */
    requestSession(request: SessionRequest): Promise<SessionResponse>;
    /**
     * Evaluate the agent's intent
     */
    private evaluateIntent;
    /**
     * Derive a scoped IAM policy from the intent
     *
     * This creates a session policy that only allows the specific
     * actions the agent wants to perform, nothing more.
     */
    private deriveScopedPolicy;
    /**
     * Parse AWS CLI command to IAM permissions
     */
    private parseAwsCliPermissions;
    /**
     * Map MCP tool to IAM permissions
     */
    private mapMcpToolPermissions;
}
/**
 * Create broker from environment
 */
export declare function createBrokerFromEnv(): SessionBroker;
//# sourceMappingURL=session-broker.d.ts.map