export declare function derivePlatformContext(appRoot: string, stack: string): string | null;
export declare function resolveStableMeshBin(argv1: string | undefined, deps?: {
    exists?: (p: string) => boolean;
    warn?: (msg: string) => void;
}): string;
export declare function renderCredentialProcessProfile(args: {
    profileName: string;
    context: string;
    roleArn: string;
    region?: string;
    meshBin: string;
}): string;
export declare function upsertManagedAwsConfigSection(existing: string, context: string, profileBlock: string): string;
export declare function stripBareProfile(existing: string, profileName: string): string;
export declare function assumeRole(roleArn: string, sessionName?: string, durationSeconds?: number): Promise<Record<string, string> | null>;
export interface StsCreds {
    AccessKeyId: string;
    SecretAccessKey: string;
    SessionToken: string;
    Expiration: string;
}
export declare function assumeRoleCredentials(roleArn: string, idToken: string, sessionName: string, durationSeconds?: number): Promise<StsCreds | null>;
export declare function assumeRoleWithWebIdentity(roleArn: string, idToken: string, sessionName: string, durationSeconds?: number): Promise<Record<string, string> | null>;
export declare function tokenIssuer(token: string): string | undefined;
export declare function describeAssumeFailure(opts: {
    roleArn: string;
    context?: string;
    issuer?: string;
}, format?: "block" | "inline"): string;
export declare function toCredentialProcessJson(creds: StsCreds): string;
export interface ResolvedAwsCreds {
    env: Record<string, string>;
    method: "environment" | "zitadel" | "sso";
}
export interface AwsIdentity {
    arn: string;
    accountId: string;
    source: "environment" | "profile";
}
export declare function probeAwsIdentity(): Promise<AwsIdentity | null>;
export declare function selectRoleForCaller(idToken: string | null, options: {
    defaultRole: string;
    adminRole?: string;
    adminClaimRoles?: string[];
}): string;
export declare function projectRoleKeys(claims: Record<string, unknown>): string[];
export declare function resolveAwsCredentials(roleArn: string, appRoot: string, stack: string): Promise<ResolvedAwsCreds | null>;