/**
 * MongoDB Atlas credentials — hand-written.
 *
 * Port of the distilled v0 Atlas credentials module: an OAuth2
 * client_credentials service-account flow. `MONGODB_ATLAS_CLIENT_ID` +
 * `MONGODB_ATLAS_CLIENT_SECRET` are exchanged for a bearer access token via
 * a Basic-auth POST to `{base}/api/oauth/token` (grant_type =
 * client_credentials).
 *
 * The `Credentials` service holds an *effect* that resolves the current
 * credentials; the protocol layer resolves it per request on the calling
 * fiber. Unlike v0 (which fetched once and ignored `expires_in`), the token
 * is cached and transparently re-fetched shortly before expiry, so
 * long-running programs keep working past the ~1h token lifetime.
 */
import * as Context from "effect/Context";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Redacted from "effect/Redacted";
import { ConfigError } from "@distilled.cloud/core/errors";
export declare const DEFAULT_API_BASE_URL = "https://cloud.mongodb.com";
export interface Config {
    readonly accessToken: Redacted.Redacted<string>;
    readonly apiBaseUrl: string;
}
declare const Credentials_base: Context.ServiceClass<Credentials, "Mongodb-atlasCredentials", Effect.Effect<Config, ConfigError, never>>;
export declare class Credentials extends Credentials_base {
}
export interface ClientCredentialsConfig {
    readonly clientId: string;
    readonly clientSecret: string;
    readonly apiBaseUrl?: string;
}
/** Layer from service-account client credentials (OAuth2 client_credentials). */
export declare const fromClientCredentials: (config: ClientCredentialsConfig) => Layer.Layer<Credentials>;
/** Layer from an already-obtained bearer access token. */
export declare const fromAccessToken: (config: {
    readonly accessToken: string;
    readonly apiBaseUrl?: string;
}) => Layer.Layer<Credentials>;
/**
 * Reads MONGODB_ATLAS_CLIENT_ID + MONGODB_ATLAS_CLIENT_SECRET (required) and
 * MONGODB_ATLAS_API_BASE_URL (optional), exchanging them for a cached OAuth2
 * access token on first use.
 */
export declare const fromEnv: () => Layer.Layer<Credentials>;
export declare const CredentialsFromEnv: Layer.Layer<Credentials>;
export {};
//# sourceMappingURL=credentials.d.ts.map