import { type AwsCredentialIdentity, type AwsCredentialIdentityProvider } from "@smithy/types";
import * as Context from "effect/Context";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import type { PlatformError } from "effect/PlatformError";
import * as Redacted from "effect/Redacted";
import type { HttpClientError } from "effect/unstable/http/HttpClientError";
export * as AWSTypes from "@aws-sdk/types";
export interface AwsCredentials {
    readonly accessKeyId: string;
    readonly secretAccessKey: string;
    readonly sessionToken?: string;
}
/**
 * Resolved credential values ready for request signing.
 */
export interface ResolvedCredentials {
    readonly accessKeyId: Redacted.Redacted<string>;
    readonly secretAccessKey: Redacted.Redacted<string>;
    readonly sessionToken: Redacted.Redacted<string> | undefined;
    readonly expiration?: number;
}
/**
 * The requirements for resolving credentials (HttpClient for SSO, FileSystem for cache).
 */
/**
 * Error types that can occur during credential resolution.
 */
export type CredentialsError = AwsCredentialProviderError | ProfileNotFound | InvalidSSOProfile | InvalidSSOToken | ExpiredSSOToken | ConflictingSSORegion | ConflictingSSOStartUrl | SsoPortalError | HttpClientError | PlatformError;
declare const Credentials_base: Context.ServiceClass<Credentials, "AWS::Credentials", Effect.Effect<ResolvedCredentials, CredentialsError, never>>;
export declare class Credentials extends Credentials_base {
}
export declare const mock: Layer.Layer<Credentials, never, never>;
/**
 * Create resolved credentials from an AWS credential identity.
 */
export declare const fromAwsCredentialIdentity: (identity: AwsCredentialIdentity) => ResolvedCredentials;
type ProviderName = "env" | "ini" | "chain" | "container" | "http" | "process" | "token-file";
export declare const providerHints: (provider: ProviderName) => ReadonlyArray<string> | undefined;
/**
 * Create a credentials effect with lazy resolution and expiration-aware caching.
 * Uses Effect.cachedWithTTL where the TTL is computed from the credentials' expiration.
 */
export declare const createCachedCredentialsEffect: <E, R>(resolve: Effect.Effect<ResolvedCredentials, E, R>) => Effect.Effect<ResolvedCredentials, E, R>;
/**
 * Create a lazy, cached credentials provider from an AWS SDK credential provider.
 * Credentials are resolved on first access and cached based on their expiration time.
 */
export declare const createLazyProvider: (provider: (config: {}) => AwsCredentialIdentityProvider, providerName: ProviderName) => Layer.Layer<Credentials>;
/**
 * Create a credentials provider from static credentials.
 * No lazy loading or caching needed since credentials are already available.
 */
export declare const fromCredentials: (credentials: AwsCredentialIdentity) => Layer.Layer<Credentials>;
export declare const fromHttp: () => Layer.Layer<Credentials, never, never>;
export declare const ssoRegion: (region: string) => Layer.Layer<SsoRegion, never, never>;
declare const SsoRegion_base: Context.ServiceClass<SsoRegion, "AWS::SsoRegion", string>;
export declare class SsoRegion extends SsoRegion_base {
}
declare const SsoStartUrl_base: Context.ServiceClass<SsoStartUrl, "AWS::SsoStartUrl", string>;
export declare class SsoStartUrl extends SsoStartUrl_base {
}
declare const ProfileNotFound_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "Alchemy::AWS::ProfileNotFound";
} & Readonly<A>;
export declare class ProfileNotFound extends ProfileNotFound_base<{
    message: string;
    profile: string;
}> {
}
declare const ConflictingSSORegion_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "Alchemy::AWS::ConflictingSSORegion";
} & Readonly<A>;
export declare class ConflictingSSORegion extends ConflictingSSORegion_base<{
    message: string;
    ssoRegion: string;
    profile: string;
}> {
}
declare const ConflictingSSOStartUrl_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "Alchemy::AWS::ConflictingSSOStartUrl";
} & Readonly<A>;
export declare class ConflictingSSOStartUrl extends ConflictingSSOStartUrl_base<{
    message: string;
    ssoStartUrl: string;
    profile: string;
}> {
}
declare const InvalidSSOProfile_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "Alchemy::AWS::InvalidSSOProfile";
} & Readonly<A>;
export declare class InvalidSSOProfile extends InvalidSSOProfile_base<{
    message: string;
    profile: string;
    missingFields: string[];
}> {
}
declare const InvalidSSOToken_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "Alchemy::AWS::InvalidSSOToken";
} & Readonly<A>;
export declare class InvalidSSOToken extends InvalidSSOToken_base<{
    message: string;
    sso_session: string;
}> {
}
declare const ExpiredSSOToken_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "Alchemy::AWS::ExpiredSSOToken";
} & Readonly<A>;
export declare class ExpiredSSOToken extends ExpiredSSOToken_base<{
    message: string;
    profile: string;
}> {
}
declare const AwsCredentialProviderError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "AWS::CredentialProviderError";
} & Readonly<A>;
export declare class AwsCredentialProviderError extends AwsCredentialProviderError_base<{
    message: string;
    provider: string;
    cause?: unknown;
    hints?: ReadonlyArray<string>;
}> {
}
declare const SsoPortalError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "Alchemy::AWS::SsoPortalError";
} & Readonly<A>;
/**
 * The AWS SSO portal returned a response with no `roleCredentials`, e.g. a
 * `ForbiddenException` when an IAM Identity Center role assignment is in a
 * stale state.
 */
export declare class SsoPortalError extends SsoPortalError_base<{
    message: string;
    profile: string;
    account_id?: string;
    role_name?: string;
    status?: number;
}> {
}
//# sourceMappingURL=credentials.browser.d.ts.map