import * as HttpClient from "effect/unstable/http/HttpClient";
import * as redacted from "effect/Redacted";
import * as S from "effect/Schema";
import * as API from "../client/api.ts";
import type { Credentials } from "../credentials.ts";
import type { CommonErrors } from "../errors.ts";
import type { Region } from "../region.ts";
export type ClientId = string;
export type GrantType = string;
export type AuthorizationCode = string;
export type RedirectUri = string;
export type CodeVerifier = string;
export type RefreshToken = string | redacted.Redacted<string>;
export type TokenType = string;
export type ExpiresIn = number;
export type IdToken = string;
export interface CreateOAuth2TokenRequestBody {
    clientId: string;
    grantType: string;
    code?: string;
    redirectUri?: string;
    codeVerifier?: string;
    refreshToken?: string | redacted.Redacted<string>;
}
export declare const CreateOAuth2TokenRequestBody: S.Schema<CreateOAuth2TokenRequestBody>;
export interface CreateOAuth2TokenRequest {
    tokenInput: CreateOAuth2TokenRequestBody;
}
export declare const CreateOAuth2TokenRequest: S.Schema<CreateOAuth2TokenRequest>;
export interface AccessToken {
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken: string;
}
export declare const AccessToken: S.Schema<AccessToken>;
export interface CreateOAuth2TokenResponseBody {
    accessToken: AccessToken;
    tokenType: string;
    expiresIn: number;
    refreshToken: string | redacted.Redacted<string>;
    idToken?: string;
}
export declare const CreateOAuth2TokenResponseBody: S.Schema<CreateOAuth2TokenResponseBody>;
export interface CreateOAuth2TokenResponse {
    tokenOutput: CreateOAuth2TokenResponseBody;
}
export declare const CreateOAuth2TokenResponse: S.Schema<CreateOAuth2TokenResponse>;
export type OAuth2ErrorCode = "TOKEN_EXPIRED" | "USER_CREDENTIALS_CHANGED" | "INSUFFICIENT_PERMISSIONS" | "AUTHCODE_EXPIRED" | "server_error" | "INVALID_REQUEST" | (string & {});
export declare const OAuth2ErrorCode: S.String;
declare const AccessDeniedException_base: S.Class<AccessDeniedException, S.TaggedStruct<"AccessDeniedException", {
    readonly error: S.String;
    readonly message: S.String;
}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        AuthError: true;
    };
});
export declare class AccessDeniedException extends AccessDeniedException_base {
}
declare const InternalServerException_base: S.Class<InternalServerException, S.TaggedStruct<"InternalServerException", {
    readonly error: S.String;
    readonly message: S.String;
}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        ServerError: true;
    };
});
export declare class InternalServerException extends InternalServerException_base {
}
declare const TooManyRequestsError_base: S.Class<TooManyRequestsError, S.TaggedStruct<"TooManyRequestsError", {
    readonly error: S.String;
    readonly message: S.String;
}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        ThrottlingError: true;
    };
});
export declare class TooManyRequestsError extends TooManyRequestsError_base {
}
declare const ValidationException_base: S.Class<ValidationException, S.TaggedStruct<"ValidationException", {
    readonly error: S.String;
    readonly message: S.String;
}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        BadRequestError: true;
    };
});
export declare class ValidationException extends ValidationException_base {
}
export type CreateOAuth2TokenError = AccessDeniedException | InternalServerException | TooManyRequestsError | ValidationException | CommonErrors;
/**
 * CreateOAuth2Token API
 *
 * Path: /v1/token
 * Request Method: POST
 * Content-Type: application/json or application/x-www-form-urlencoded
 *
 * This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both:
 * 1. Authorization code redemption (grant_type=authorization_code) - NOT idempotent
 * 2. Token refresh (grant_type=refresh_token) - Idempotent within token validity window
 *
 * The operation behavior is determined by the grant_type parameter in the request body:
 *
 * **Authorization Code Flow (NOT Idempotent):**
 * - JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier
 * - Returns access_token, token_type, expires_in, refresh_token, and id_token
 * - Each authorization code can only be used ONCE for security (prevents replay attacks)
 *
 * **Token Refresh Flow (Idempotent):**
 * - JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token
 * - Returns access_token, token_type, expires_in, and refresh_token (no id_token)
 * - Multiple calls with same refresh_token return consistent results within validity window
 *
 * Authentication and authorization:
 * - Confidential clients: sigv4 signing required with signin:ExchangeToken permissions
 * - CLI clients (public): authn/authz skipped based on client_id & grant_type
 *
 * Note: This operation cannot be marked as @idempotent because it handles both idempotent
 * (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.
 */
export declare const createOAuth2Token: API.OperationMethod<CreateOAuth2TokenRequest, CreateOAuth2TokenResponse, CreateOAuth2TokenError, Credentials | Region | HttpClient.HttpClient>;
export {};
//# sourceMappingURL=signin.d.ts.map