import { Command } from "commander";
import { type AwsIdentity } from "../utils/aws-auth.js";
declare const CONFIG_DIR: string;
declare const CONFIG_FILE: string;
declare const CREDENTIALS_FILE: string;
interface ContextConfig {
    issuer: string;
    clientId: string;
    defaultRole?: string;
    adminRole?: string;
    adminClaimRoles?: string[];
    vpn?: string;
    vpnJoinBroker?: string;
    registryBroker?: string;
}
interface CachedCredentials {
    idToken: string;
    accessToken: string;
    refreshToken?: string;
    expiresAt: string;
    email?: string;
    sub?: string;
}
type ConfigFile = Record<string, ContextConfig>;
type CredentialsFile = Record<string, CachedCredentials>;
export declare function writeContextConfig(context: string, config: ContextConfig): void;
export declare function clearContextConfig(context: string): void;
declare function getContextConfig(context: string): ContextConfig | null;
export declare function discoverConfigFromWellKnown(domain: string, contextKey?: string, opts?: {
    quiet?: boolean;
}): Promise<ContextConfig | null>;
declare function readAllCredentials(): CredentialsFile;
declare function readCredentials(context: string): CachedCredentials | null;
export declare function atomicWriteFileSync(path: string, data: string, mode: number): void;
declare function clearCredentials(context: string): void;
declare function decodeJwtPayload(token: string): Record<string, unknown>;
export declare function deviceLoginWithReissue(attempt: (codeNumber: number) => Promise<"success" | "expired">, maxCodes?: number): Promise<void>;
export declare function loginTimeoutMessage(context: string): string;
export declare function isRemoteEnvironment(): boolean;
export interface StatusLine {
    level: "success" | "info" | "warn";
    text: string;
}
export declare function accountIdFromRoleArn(roleArn: string | undefined): string | undefined;
export declare function renderAwsFallbackStatus(context: string, reason: string, identity: AwsIdentity | null, expectedAccountId?: string): {
    lines: StatusLine[];
    exitCode: 0 | 1;
};
export declare function registerLoginCommand(program: Command): void;
export declare const RESERVED_REGISTRY_CONTEXT = "registry";
export declare const NO_REGISTRY_DEPRECATED = "--no-registry is deprecated and ignored: mesh login no longer touches the registry.";
export declare const REGISTRY_SEPARATE_HINT = "Package registry access is separate from platform sign-in \u2014 run: mesh registry login";
export declare function renderNoConfigHelp(context: string): string;
export declare function tokenStillValid(expiresAt: string, marginMs?: number, now?: number): boolean;
declare function getValidToken(context: string, opts?: {
    marginMs?: number;
}): Promise<string | null>;
export declare function forceRefreshToken(context: string): Promise<string | null>;
export type CredProbe = {
    state: "ok";
    ttlSeconds: number;
    expiresAt: string;
    email?: string;
} | {
    state: "no-session";
} | {
    state: "expired-session";
} | {
    state: "assume-denied";
    detail: string;
} | {
    state: "stale-env-override";
};
export declare function probeCredentials(context: string, roleArn: string): Promise<CredProbe>;
export declare function renderExportStaticLines(args: {
    accessKey: string;
    secretKey: string;
    sessionToken: string;
    region: string;
}): string;
export declare function renderExportProfileLines(args: {
    profileName: string;
    region: string;
}): string;
export declare function resolveUserAwsConfigPath(env?: Record<string, string | undefined>): string;
export declare function resolveAwsConfigTarget(env?: Record<string, string | undefined>): {
    configPath: string;
    redirected: boolean;
};
export declare function resolveRoleOrExplain(opts: {
    role?: string;
}, config: {
    defaultRole?: string;
}): {
    role: string;
} | {
    error: string;
};
export declare function runLoginFlow(context: string, config: ContextConfig, opts?: {
    device?: boolean;
}): Promise<void>;
export declare function ensureLogin(context: string, opts?: {
    device?: boolean;
    interactive?: boolean;
}): Promise<CachedCredentials | null>;
export { CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE };
export type { ContextConfig, CachedCredentials, CredentialsFile };
export declare function readAllContextConfigs(): ConfigFile;
export declare function discoverConfigForContext(context: string): Promise<ContextConfig | null>;
export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken, clearCredentials };