/**
 * IAM identity information returned by STS GetCallerIdentity.
 */
export interface IamIdentity {
    /** AWS account ID */
    readonly accountId: string;
    /** IAM ARN (user, role, or assumed role) */
    readonly arn: string;
    /** User ID or role session name */
    readonly userId: string;
}
/**
 * Parsed IAM identity with extracted components.
 */
export interface ParsedIamIdentity extends IamIdentity {
    /** Type of IAM principal: 'user', 'role', 'assumed-role', 'federated-user', 'root' */
    readonly principalType: IamPrincipalType;
    /** Extracted username or role name */
    readonly principalName: string;
    /** Role session name (for assumed roles) */
    readonly sessionName?: string;
}
/**
 * Types of IAM principals.
 */
export type IamPrincipalType = 'user' | 'role' | 'assumed-role' | 'federated-user' | 'root' | 'unknown';
/**
 * Configuration for DevIdResolver.
 */
export interface DevIdResolverConfig {
    /** AWS region for STS calls */
    readonly region?: string;
    /** AWS profile name */
    readonly profile?: string;
    /** Explicit devId override (takes precedence over IAM derivation) */
    readonly explicitDevId?: string;
    /** Template string for devId (e.g., '${AWS_IAM_USER}') */
    readonly devIdTemplate?: string;
}
/**
 * Result of devId resolution.
 */
export interface DevIdResolutionResult {
    /** Resolved developer ID */
    readonly devId: string;
    /** Source of the devId: 'explicit', 'iam-user', 'iam-role', 'iam-assumed-role', 'template' */
    readonly source: DevIdSource;
    /** Original IAM identity (if derived from IAM) */
    readonly iamIdentity?: ParsedIamIdentity;
}
/**
 * Source of the resolved devId.
 */
export type DevIdSource = 'explicit' | 'iam-user' | 'iam-role' | 'iam-assumed-role' | 'iam-federated' | 'template' | 'fallback';
/**
 * Template variables supported in devId templates.
 */
export declare const DEV_ID_TEMPLATE_VARIABLES: {
    /** IAM username (for IAM users) */
    readonly AWS_IAM_USER: "${AWS_IAM_USER}";
    /** IAM role name (for roles) */
    readonly AWS_IAM_ROLE: "${AWS_IAM_ROLE}";
    /** Role session name (for assumed roles) */
    readonly AWS_ROLE_SESSION: "${AWS_ROLE_SESSION}";
    /** AWS account ID */
    readonly AWS_ACCOUNT_ID: "${AWS_ACCOUNT_ID}";
    /** Full IAM ARN */
    readonly AWS_IAM_ARN: "${AWS_IAM_ARN}";
};
/**
 * Error thrown when devId resolution fails.
 */
export declare class DevIdResolutionError extends Error {
    readonly cause?: Error | undefined;
    constructor(message: string, cause?: Error | undefined);
}
/**
 * Parse an IAM ARN to extract identity components.
 *
 * Supports the following ARN formats:
 * - IAM User: arn:aws:iam::123456789012:user/username
 * - IAM User with path: arn:aws:iam::123456789012:user/path/to/username
 * - IAM Role: arn:aws:iam::123456789012:role/rolename
 * - Assumed Role: arn:aws:sts::123456789012:assumed-role/rolename/session-name
 * - Federated User: arn:aws:sts::123456789012:federated-user/username
 * - Root: arn:aws:iam::123456789012:root
 *
 * @param arn - IAM ARN to parse
 * @param accountId - AWS account ID
 * @param userId - User ID from STS
 * @returns Parsed IAM identity
 *
 * @see Requirements 3.1
 */
export declare function parseIamArn(arn: string, accountId: string, userId: string): ParsedIamIdentity;
/**
 * Sanitize a string to be used as a devId.
 *
 * DevIds must:
 * - Contain only alphanumeric characters, hyphens, and underscores
 * - Not start or end with a hyphen or underscore
 * - Be lowercase
 * - Be between 1 and 64 characters
 *
 * @param input - Input string to sanitize
 * @returns Sanitized devId
 *
 * @see Requirements 3.1
 */
export declare function sanitizeDevId(input: string): string;
/**
 * Check if a string is a valid devId.
 *
 * @param devId - String to validate
 * @returns True if valid devId
 */
export declare function isValidDevId(devId: string): boolean;
/**
 * Check if a devId template contains template variables.
 *
 * @param template - Template string to check
 * @returns True if template contains variables
 */
export declare function isDevIdTemplate(template: string): boolean;
/**
 * Resolve template variables in a devId template.
 *
 * @param template - Template string with variables
 * @param identity - Parsed IAM identity for variable substitution
 * @returns Resolved devId
 *
 * @see Requirements 3.1
 */
export declare function resolveDevIdTemplate(template: string, identity: ParsedIamIdentity): string;
/**
 * Derive devId from IAM identity.
 *
 * Strategy:
 * - IAM User: Use username
 * - Assumed Role: Use session name (typically contains username)
 * - IAM Role: Use role name
 * - Federated User: Use federated username
 * - Root: Use 'root-{accountId}'
 *
 * @param identity - Parsed IAM identity
 * @returns Derived devId and source
 *
 * @see Requirements 3.1
 */
export declare function deriveDevIdFromIdentity(identity: ParsedIamIdentity): {
    devId: string;
    source: DevIdSource;
};
/**
 * DevIdResolver - Resolves developer IDs from IAM identity or configuration.
 *
 * Provides multi-developer isolation by ensuring each developer has a unique,
 * deterministic ID derived from their AWS IAM identity or explicit configuration.
 *
 * **Resolution Priority**:
 * 1. Explicit devId override (from config or CLI option)
 * 2. Template resolution (e.g., '${AWS_IAM_USER}')
 * 3. IAM identity derivation (automatic)
 *
 * @see Requirements 3.1
 *
 * @example
 * ```typescript
 * const resolver = new DevIdResolver({ region: 'us-east-1' });
 *
 * // Automatic derivation from IAM
 * const result = await resolver.resolve();
 * console.log(result.devId); // 'john-doe'
 * console.log(result.source); // 'iam-user'
 *
 * // Explicit override
 * const resolver2 = new DevIdResolver({ explicitDevId: 'my-custom-id' });
 * const result2 = await resolver2.resolve();
 * console.log(result2.devId); // 'my-custom-id'
 * console.log(result2.source); // 'explicit'
 *
 * // Template resolution
 * const resolver3 = new DevIdResolver({ devIdTemplate: '${AWS_IAM_USER}-dev' });
 * const result3 = await resolver3.resolve();
 * console.log(result3.devId); // 'john-doe-dev'
 * console.log(result3.source); // 'template'
 * ```
 */
export declare class DevIdResolver {
    private readonly config;
    private stsClient;
    private cachedIdentity;
    /**
     * Create a new DevIdResolver.
     *
     * @param config - Resolver configuration
     */
    constructor(config?: DevIdResolverConfig);
    /**
     * Resolve the developer ID.
     *
     * Resolution priority:
     * 1. Explicit devId override
     * 2. Template resolution
     * 3. IAM identity derivation
     *
     * @returns Resolution result with devId and source
     * @throws DevIdResolutionError if resolution fails
     *
     * @see Requirements 3.1
     */
    resolve(): Promise<DevIdResolutionResult>;
    /**
     * Get the current IAM identity.
     *
     * Caches the result to avoid repeated STS calls.
     *
     * @returns Parsed IAM identity
     * @throws DevIdResolutionError if STS call fails
     */
    getIamIdentity(): Promise<ParsedIamIdentity>;
    /**
     * Get or create the STS client.
     *
     * @returns STS client
     * @private
     */
    private getStsClient;
    /**
     * Clear the cached IAM identity.
     *
     * Useful for testing or when credentials change.
     */
    clearCache(): void;
}
/**
 * Resolve devId from configuration.
 *
 * Convenience function that creates a DevIdResolver and resolves the devId.
 *
 * @param config - Resolver configuration
 * @returns Resolution result
 *
 * @see Requirements 3.1
 *
 * @example
 * ```typescript
 * // Automatic derivation
 * const result = await resolveDevId({ region: 'us-east-1' });
 *
 * // With explicit override
 * const result2 = await resolveDevId({ explicitDevId: 'my-dev-id' });
 *
 * // With template
 * const result3 = await resolveDevId({ devIdTemplate: '${AWS_IAM_USER}' });
 * ```
 */
export declare function resolveDevId(config?: DevIdResolverConfig): Promise<DevIdResolutionResult>;
/**
 * Resolve devId synchronously from explicit value or template.
 *
 * This function does NOT call AWS STS. Use only when you have an explicit
 * devId or want to validate a template without resolution.
 *
 * @param devIdOrTemplate - Explicit devId or template string
 * @returns Sanitized devId (or original if template)
 * @throws DevIdResolutionError if devId is invalid
 */
export declare function resolveDevIdSync(devIdOrTemplate: string): string;
