import { Effect, Layer } from "effect";
import { HttpClient } from "effect/unstable/http";
import type { IFumaClient, StorageFailure } from "./fuma-runtime";
import { CreateConnectionInput, type ConnectionProvider, type ConnectionRef } from "./connections";
import type { ConnectionProviderNotRegisteredError } from "./errors";
import { SetSecretInput, type SecretRef } from "./secrets";
import { type OAuthService } from "./oauth";
import { type OAuthEndpointUrlPolicy } from "./oauth-helpers";
export interface OAuthServiceDeps {
    readonly fuma: IFumaClient;
    /** Resolves client-id / client-secret refs at start + refresh time.
     *  A `null` return means "secret row is gone" and aborts the flow. */
    readonly secretsGet: (id: string) => Effect.Effect<string | null, StorageFailure>;
    readonly secretsGetResolved?: (id: string) => Effect.Effect<{
        readonly value: string;
        readonly scopeId: string | null;
    } | null, StorageFailure>;
    readonly secretsGetAtScope?: (id: string, scope: string) => Effect.Effect<string | null, StorageFailure>;
    readonly secretsSet: (input: SetSecretInput) => Effect.Effect<SecretRef, StorageFailure>;
    /** Mints the Connection row + backing secret rows. Called from
     *  `complete` (and from `start` for `client-credentials`). */
    readonly connectionsCreate: (input: CreateConnectionInput) => Effect.Effect<ConnectionRef, ConnectionProviderNotRegisteredError | StorageFailure>;
    /** Reads an existing Connection so dynamic-DCR retries can reuse the
     *  registered OAuth client instead of registering a new client every
     *  time the user restarts a browser flow. */
    readonly connectionsGet?: (id: string) => Effect.Effect<ConnectionRef | null, StorageFailure>;
    /** Random session id generator. Tests override to make outputs
     *  deterministic. */
    readonly newSessionId?: () => string;
    /** `Date.now()` substitute — tests override to drive TTL behavior. */
    readonly now?: () => number;
    /** Outbound HTTP client used for OAuth metadata/DCR probes. */
    readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
}
export declare const makeOAuth2Service: (deps: OAuthServiceDeps) => {
    readonly service: OAuthService;
    readonly connectionProvider: ConnectionProvider;
};
//# sourceMappingURL=oauth-service.d.ts.map