import { Schema } from "effect";
import type { AuthMethodDescriptor } from "../integration";
/** The canonical input variable of single-credential methods. A placement
 *  with no `variable` renders from it, and core resolves a connection created
 *  with a bare `{ value }` into `{ token: value }`. */
export declare const TOKEN_VARIABLE = "token";
export declare const AuthCarrier: Schema.Literals<readonly ["header", "query"]>;
export type AuthCarrier = typeof AuthCarrier.Type;
/** One spot on the outbound request a method writes to.
 *
 *  Credential placement: renders `prefix + values[variable ?? "token"]`.
 *  Two placements naming the same variable share one credential input; a
 *  placement naming its own variable gets its own input (e.g. Datadog's two
 *  keys).
 *
 *  Literal placement (`literal` set): renders the literal verbatim and
 *  references no credential — static values a method carries alongside its
 *  credential (e.g. a fixed version header). */
export declare const AuthPlacement: Schema.Struct<{
    readonly carrier: Schema.Literals<readonly ["header", "query"]>;
    /** Header name (e.g. `Authorization`) or query-param name (e.g. `token`). */
    readonly name: Schema.String;
    /** Literal prepended to the credential value, e.g. `Bearer `. */
    readonly prefix: Schema.optional<Schema.String>;
    /** The credential input this placement renders from. Absent ⇒ `token`. */
    readonly variable: Schema.optional<Schema.String>;
    /** Render this exact value instead of a credential. */
    readonly literal: Schema.optional<Schema.String>;
}>;
export type AuthPlacement = typeof AuthPlacement.Type;
export declare const ApiKeyAuthMethod: Schema.Struct<{
    readonly slug: Schema.String;
    readonly kind: Schema.Literal<"apikey">;
    /** Display label; derived from the first placement when absent. */
    readonly label: Schema.optional<Schema.String>;
    readonly placements: Schema.$Array<Schema.Struct<{
        readonly carrier: Schema.Literals<readonly ["header", "query"]>;
        /** Header name (e.g. `Authorization`) or query-param name (e.g. `token`). */
        readonly name: Schema.String;
        /** Literal prepended to the credential value, e.g. `Bearer `. */
        readonly prefix: Schema.optional<Schema.String>;
        /** The credential input this placement renders from. Absent ⇒ `token`. */
        readonly variable: Schema.optional<Schema.String>;
        /** Render this exact value instead of a credential. */
        readonly literal: Schema.optional<Schema.String>;
    }>>;
}>;
export type ApiKeyAuthMethod = typeof ApiKeyAuthMethod.Type;
/** An open integration — connections carry no credential. */
export declare const NoneAuthMethod: Schema.Struct<{
    readonly slug: Schema.String;
    readonly kind: Schema.Literal<"none">;
}>;
export type NoneAuthMethod = typeof NoneAuthMethod.Type;
export interface RenderedAuthPlacements {
    readonly headers: Record<string, string>;
    readonly queryParams: Record<string, string>;
}
/** Render a method's placements with a connection's resolved values. Total:
 *  a credential placement whose variable resolved to nothing is skipped —
 *  callers own their missing-value policy (fail the invocation, dial
 *  unauthenticated, …) and should gate on `requiredPlacementVariables`. */
export declare const renderAuthPlacements: (placements: readonly AuthPlacement[], values: Record<string, string | null>) => RenderedAuthPlacements;
/** The distinct credential inputs a method's placements reference — what a
 *  connection must supply. Literal placements reference none. */
export declare const requiredPlacementVariables: (placements: readonly AuthPlacement[]) => readonly string[];
/** The conventional rendering of an OAuth access token, as a placement — for
 *  plugins whose oauth method applies the token as a plain (possibly
 *  customized) header. The token is always the `token` input. */
export declare const oauthBearerPlacement: (header?: string, prefix?: string) => AuthPlacement;
/** Assign each method a stable slug: a caller-provided one wins, otherwise
 *  `defaultSlugFor(method)`, suffixed `_2`, `_3`, … on collision. */
export declare const normalizeAuthMethodSlugs: <T extends {
    readonly slug?: string | undefined;
}>(methods: readonly T[], defaultSlugFor: (method: T) => string) => readonly (T & {
    readonly slug: string;
})[];
export declare const apiKeyMethodLabel: (method: ApiKeyAuthMethod) => string;
export declare const describeApiKeyAuthMethod: (method: ApiKeyAuthMethod) => AuthMethodDescriptor;
export declare const describeNoneAuthMethod: (slug: string) => AuthMethodDescriptor;
//# sourceMappingURL=auth-method.d.ts.map