export interface AWSCredentials {
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
}
export interface AWSRequestOptions {
    service: string;
    region: string;
    method: string;
    path: string;
    queryParams?: Record<string, string>;
    headers?: Record<string, string>;
    body?: string;
    credentials?: AWSCredentials;
    retries?: number;
    cacheKey?: string;
    cacheTTL?: number;
    returnHeaders?: boolean;
    rawResponse?: boolean;
    /** S3 bucket name for virtual-hosted style URLs */
    bucket?: string;
}
export interface AWSClientConfig {
    maxRetries?: number;
    retryDelay?: number;
    cacheEnabled?: boolean;
    defaultCacheTTL?: number;
    /**
     * Named profile in `~/.aws/credentials` to load static keys from. Falls back
     * to `AWS_PROFILE` then `default`. Pass this instead of pre-resolving creds —
     * the resolver is async, so handing the client a Promise silently breaks
     * signing.
     */
    profile?: string;
    /**
     * Override the S3 endpoint host for S3-compatible providers (Backblaze B2,
     * Hetzner Object Storage). Host only, no scheme — e.g.
     * `s3.us-west-004.backblazeb2.com` or `fsn1.your-objectstorage.com`.
     * When omitted, the standard AWS S3 endpoint is used.
     */
    endpoint?: string;
    /**
     * Force path-style addressing (bucket in the path) instead of
     * virtual-hosted style (bucket in the host). Defaults to virtual-hosted,
     * which AWS, Backblaze B2 and Hetzner all support.
     */
    forcePathStyle?: boolean;
}
/**
 * Resolve the S3 (or S3-compatible) host and canonical request path.
 *
 * Supports AWS S3 plus S3-compatible providers (Backblaze B2, Hetzner Object
 * Storage) by allowing an endpoint override and path- vs virtual-hosted-style
 * addressing. With no `endpoint` and no `forcePathStyle` the AWS host and path
 * are preserved while the default HTTPS transport is made explicit.
 *
 * The returned `path` is used for BOTH the request URL and the SigV4 canonical
 * URI, so the signature always matches the wire request.
 */
export declare function resolveS3Endpoint(options: {
    region: string;
    /** Original request path, e.g. '/key', '/bucket/key' or '/'. */
    path: string;
    /** Bucket name when the request is bucket-scoped (virtual-hosted eligible). */
    bucket?: string;
    /** Endpoint host override, e.g. 's3.us-west-004.backblazeb2.com'. */
    endpoint?: string;
    /** Force path-style addressing (bucket in path) instead of virtual-hosted. */
    forcePathStyle?: boolean;
}): {
    protocol: 'http' | 'https';
    host: string;
    path: string;
};
export interface AWSError extends Error {
    code?: string;
    statusCode?: number;
    requestId?: string;
    type?: string;
}
/**
 * AWS API Client - Makes authenticated requests to AWS services
 */
export declare class AWSClient {
    private credentials?;
    private config;
    private cache;
    private xmlParser;
    constructor(credentials?: AWSCredentials, config?: AWSClientConfig);
    /**
     * Load AWS credentials from environment variables, credentials file, or EC2 instance metadata
     */
    private loadCredentials;
    /**
     * Load credentials from ~/.aws/credentials file
     */
    private loadCredentialsFromFile;
    /**
     * Parse AWS credentials file (INI format)
     */
    private parseCredentialsFile;
    /**
     * Cache for EC2 instance metadata credentials
     */
    private ec2CredentialsCache?;
    /**
     * Get credentials, fetching from credentials file or EC2 metadata if needed
     */
    private getCredentials;
    /**
     * Make a signed AWS API request with retry logic and caching
     */
    request(options: AWSRequestOptions): Promise<any>;
    /**
     * Make the actual HTTP request
     */
    private makeRequest;
    /**
     * Convert Headers object to plain object
     */
    private headersToObject;
    /**
     * Build the full URL for the request
     */
    private buildUrl;
    /**
     * Sign the request using AWS Signature Version 4
     */
    private signRequest;
    /**
     * Get AMZ date format (YYYYMMDDTHHMMSSZ)
     */
    private getAmzDate;
    /**
     * Get date stamp (YYYYMMDD)
     */
    private getDateStamp;
    /**
     * URI-encode a string per RFC 3986
     */
    private uriEncode;
    /**
     * SHA256 hash
     */
    private sha256;
    /**
     * HMAC SHA256
     */
    private hmac;
    /**
     * Get signature key
     */
    private getSignatureKey;
    /**
     * Parse XML response using ts-xml
     */
    private parseXmlResponse;
    /**
     * Parse error response and create detailed error object
     */
    private parseError;
    /**
     * Create error from XML error object
     */
    private createErrorFromXml;
    /**
     * Check if error code is retryable
     */
    private isRetryableError;
    /**
     * Check if HTTP status code is retryable
     */
    private isRetryableStatusCode;
    /**
     * Determine if an error should be retried
     */
    private shouldRetry;
    /**
     * Calculate retry delay with exponential backoff
     */
    private calculateRetryDelay;
    /**
     * Sleep for specified milliseconds
     */
    private sleep;
    /**
     * Get value from cache
     */
    private getFromCache;
    /**
     * Set value in cache
     */
    private setInCache;
    /**
     * Clear cache
     */
    clearCache(): void;
    /**
     * Clear expired cache entries
     */
    clearExpiredCache(): void;
}
/**
 * Build query string for AWS API calls
 */
export declare function buildQueryParams(params: Record<string, any>): Record<string, string>;
/**
 * Describes where AWS credentials will be loaded from based on current env state.
 * Useful for diagnostics — surfaces which source the deploy will actually use
 * before any AWS calls happen.
 */
export interface CredentialSourceInfo {
    source: 'env' | 'file' | 'ec2' | 'none';
    /** Profile name when source is 'file' */
    profile?: string;
    /** Empty AWS_ACCESS_KEY_ID env var was found — likely a misconfigured .env */
    emptyEnvKey?: boolean;
    /** Empty AWS_SECRET_ACCESS_KEY env var was found */
    emptyEnvSecret?: boolean;
    /** Human-readable description */
    description: string;
}
export declare function detectCredentialSource(): CredentialSourceInfo;
