import * as Context from "effect/Context";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Redacted from "effect/Redacted";
export interface Config {
    /**
     * Bearer token for authenticating to the Kubernetes API server.
     * This can be a service account token, an OIDC token, an EKS
     * presigned STS token, or any token accepted by the cluster's
     * authentication layer.
     */
    readonly token: Redacted.Redacted<string>;
    /**
     * Base URL of the Kubernetes API server.
     *
     * There is no default — the URL must always be provided explicitly
     * because it varies per cluster (e.g. EKS endpoint, GKE endpoint,
     * `https://localhost:6443`, etc.).
     */
    readonly apiBaseUrl: string;
}
declare const Credentials_base: Context.ServiceClass<Credentials, "KubernetesCredentials", Effect.Effect<Config, never, never>>;
export declare class Credentials extends Credentials_base {
}
/**
 * Build a credentials layer from environment variables.
 *
 * | Variable | Required | Description |
 * |---|---|---|
 * | `KUBERNETES_TOKEN` | yes | Bearer token for authentication |
 * | `KUBERNETES_API_URL` | yes | API server URL (e.g. from `kubectl cluster-info`) |
 */
export declare const CredentialsFromEnv: Layer.Layer<Credentials, never, never>;
export {};
//# sourceMappingURL=credentials.d.ts.map