import { Effect, Schema } from "effect";
import { ConnectionId, ScopeId } from "./ids";
/** Minimal JSON-object carrier for the plugin-owned `providerState`
 *  blob. The SDK never inspects its shape; plugins encode/decode their
 *  own structure. Never sensitive — that's what the secret rows are
 *  for. */
export declare const ConnectionProviderState: Schema.$Record<Schema.String, Schema.Unknown>;
export type ConnectionProviderState = typeof ConnectionProviderState.Type;
export declare const ConnectionRef: Schema.Struct<{
    readonly id: Schema.brand<Schema.String, "ConnectionId">;
    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
    readonly provider: Schema.String;
    readonly identityLabel: Schema.NullOr<Schema.String>;
    readonly accessTokenSecretId: Schema.brand<Schema.String, "SecretId">;
    readonly refreshTokenSecretId: Schema.NullOr<Schema.brand<Schema.String, "SecretId">>;
    /** Epoch ms when the access token expires; null if not declared. */
    readonly expiresAt: Schema.NullOr<Schema.Number>;
    /** OAuth-style scope string as returned by the token endpoint. Named
     *  `oauthScope` to avoid collision with the executor scope id. */
    readonly oauthScope: Schema.NullOr<Schema.String>;
    readonly providerState: Schema.NullOr<Schema.$Record<Schema.String, Schema.Unknown>>;
    readonly createdAt: Schema.Date;
    readonly updatedAt: Schema.Date;
}>;
export type ConnectionRef = typeof ConnectionRef.Type;
export declare const TokenMaterial: Schema.Struct<{
    /** Target secret id. Plugins typically derive this from the source id
     *  + a stable suffix (e.g. `${sourceId}.access_token`). */
    readonly secretId: Schema.brand<Schema.String, "SecretId">;
    /** Display name stamped on the secret row. Only visible to code — the
     *  Connections UI hides connection-owned secrets. */
    readonly name: Schema.String;
    readonly value: Schema.String;
}>;
export type TokenMaterial = typeof TokenMaterial.Type;
export declare const CreateConnectionInput: Schema.Struct<{
    readonly id: Schema.brand<Schema.String, "ConnectionId">;
    /** Executor scope id that will own this connection + its backing
     *  secrets. This is the sharing boundary: a user scope is personal,
     *  an org/workspace scope is shared with descendants. */
    readonly scope: Schema.brand<Schema.String, "ScopeId">;
    readonly provider: Schema.String;
    readonly identityLabel: Schema.NullOr<Schema.String>;
    readonly accessToken: Schema.Struct<{
        /** Target secret id. Plugins typically derive this from the source id
         *  + a stable suffix (e.g. `${sourceId}.access_token`). */
        readonly secretId: Schema.brand<Schema.String, "SecretId">;
        /** Display name stamped on the secret row. Only visible to code — the
         *  Connections UI hides connection-owned secrets. */
        readonly name: Schema.String;
        readonly value: Schema.String;
    }>;
    readonly refreshToken: Schema.NullOr<Schema.Struct<{
        /** Target secret id. Plugins typically derive this from the source id
         *  + a stable suffix (e.g. `${sourceId}.access_token`). */
        readonly secretId: Schema.brand<Schema.String, "SecretId">;
        /** Display name stamped on the secret row. Only visible to code — the
         *  Connections UI hides connection-owned secrets. */
        readonly name: Schema.String;
        readonly value: Schema.String;
    }>>;
    readonly expiresAt: Schema.NullOr<Schema.Number>;
    /** OAuth-style scope string. Distinct from the executor scope above. */
    readonly oauthScope: Schema.NullOr<Schema.String>;
    readonly providerState: Schema.NullOr<Schema.$Record<Schema.String, Schema.Unknown>>;
}>;
export type CreateConnectionInput = typeof CreateConnectionInput.Type;
declare const ConnectionRefreshError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "ConnectionRefreshError";
} & Readonly<A>;
export declare class ConnectionRefreshError extends ConnectionRefreshError_base<{
    readonly connectionId: ConnectionId;
    readonly message: string;
    /**
     * Set by providers when the refresh failed in a way that the stored
     * refresh token cannot recover from (RFC 6749 §5.2 `invalid_grant`
     * — the AS has revoked the grant, the user changed their password,
     * the refresh token rotated out from under us, ...). The SDK
     * translates this into a `ConnectionReauthRequiredError` so callers
     * can prompt the user to sign in again instead of silently retrying.
     */
    readonly reauthRequired?: boolean;
    readonly cause?: unknown;
}> {
}
export interface ConnectionRefreshInput {
    readonly connectionId: ConnectionId;
    readonly scopeId: ScopeId;
    readonly identityLabel: string | null;
    /** Resolved refresh token value, or null if the connection has none. */
    readonly refreshToken: string | null;
    /** Plugin-owned blob persisted at create / previous refresh. */
    readonly providerState: ConnectionProviderState | null;
    /** OAuth scope string from the last token issuance. */
    readonly oauthScope: string | null;
}
export interface ConnectionRefreshResult {
    readonly accessToken: string;
    readonly refreshToken?: string | null;
    readonly expiresAt?: number | null;
    readonly oauthScope?: string | null;
    readonly providerState?: ConnectionProviderState | null;
}
export interface ConnectionProvider {
    readonly key: string;
    readonly refresh?: (input: ConnectionRefreshInput) => Effect.Effect<ConnectionRefreshResult, ConnectionRefreshError>;
}
export declare const UpdateConnectionTokensInput: Schema.Struct<{
    readonly id: Schema.brand<Schema.String, "ConnectionId">;
    readonly accessToken: Schema.String;
    readonly refreshToken: Schema.optional<Schema.NullOr<Schema.String>>;
    readonly expiresAt: Schema.optional<Schema.NullOr<Schema.Number>>;
    readonly oauthScope: Schema.optional<Schema.NullOr<Schema.String>>;
    readonly providerState: Schema.optional<Schema.NullOr<Schema.$Record<Schema.String, Schema.Unknown>>>;
    readonly identityLabel: Schema.optional<Schema.NullOr<Schema.String>>;
}>;
export type UpdateConnectionTokensInput = typeof UpdateConnectionTokensInput.Type;
export declare const RemoveConnectionInput: Schema.Struct<{
    readonly id: Schema.brand<Schema.String, "ConnectionId">;
    /** Scope id whose connection row and owned token secrets should be removed. */
    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
}>;
export type RemoveConnectionInput = typeof RemoveConnectionInput.Type;
export {};
//# sourceMappingURL=connections.d.ts.map