import { Context, Effect, Layer, Option, Schema } from 'effect';
import type { ProviderConfig, ProviderDefinition } from './provider';
/** A persisted provider-connection identifier. */
export declare const ProviderConnectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
export type ProviderConnectionId = Schema.Schema.Type<typeof ProviderConnectionId>;
/** Consumer-owned isolation boundary for persisted provider connections. */
export declare const ProviderConnectionNamespace: Schema.brand<Schema.filter<typeof Schema.String>, "@fred/ProviderConnectionNamespace">;
export type ProviderConnectionNamespace = Schema.Schema.Type<typeof ProviderConnectionNamespace>;
export declare const ProviderConnectionProtocolSchema: Schema.Literal<["openai-compatible", "anthropic-compatible"]>;
export type ProviderConnectionProtocol = Schema.Schema.Type<typeof ProviderConnectionProtocolSchema>;
export declare const ProviderConnectionAuthSchema: Schema.Union<[Schema.Struct<{
    kind: Schema.Literal<["none"]>;
}>, Schema.Struct<{
    kind: Schema.Literal<["api-key"]>;
}>, Schema.Struct<{
    kind: Schema.Literal<["basic"]>;
}>, Schema.Struct<{
    kind: Schema.Literal<["oauth2-bearer"]>;
}>]>;
export type ProviderConnectionAuth = Schema.Schema.Type<typeof ProviderConnectionAuthSchema>;
export type ProviderConnectionAuthKind = ProviderConnectionAuth['kind'];
export declare const ProviderLoginMethodSchema: Schema.Literal<["manual-secret", "google-installed-app", "openrouter-pkce-api-key"]>;
export type ProviderLoginMethod = Schema.Schema.Type<typeof ProviderLoginMethodSchema>;
export declare const ProviderConnectionStatusSchema: Schema.Literal<["active", "disabled", "deleted"]>;
export type ProviderConnectionStatus = Schema.Schema.Type<typeof ProviderConnectionStatusSchema>;
export declare const ProviderConnectionEndpointSchema: Schema.filter<typeof Schema.String>;
/** Public, non-secret connection metadata. */
export declare const ProviderConnectionSchema: Schema.Struct<{
    id: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    label: typeof Schema.String;
    providerId: typeof Schema.String;
    endpoint: Schema.optional<Schema.filter<typeof Schema.String>>;
    protocol: Schema.optional<Schema.Literal<["openai-compatible", "anthropic-compatible"]>>;
    auth: Schema.Union<[Schema.Struct<{
        kind: Schema.Literal<["none"]>;
    }>, Schema.Struct<{
        kind: Schema.Literal<["api-key"]>;
    }>, Schema.Struct<{
        kind: Schema.Literal<["basic"]>;
    }>, Schema.Struct<{
        kind: Schema.Literal<["oauth2-bearer"]>;
    }>]>;
    status: Schema.Literal<["active", "disabled", "deleted"]>;
}>;
export type ProviderConnection = Schema.Schema.Type<typeof ProviderConnectionSchema>;
/** An unsaved connection. It intentionally has no identifier or secret fields. */
export declare const ProviderConnectionDraftSchema: Schema.Struct<{
    label: typeof Schema.String;
    providerId: typeof Schema.String;
    endpoint: Schema.optional<Schema.filter<typeof Schema.String>>;
    protocol: Schema.optional<Schema.Literal<["openai-compatible", "anthropic-compatible"]>>;
    auth: Schema.Union<[Schema.Struct<{
        kind: Schema.Literal<["none"]>;
    }>, Schema.Struct<{
        kind: Schema.Literal<["api-key"]>;
    }>, Schema.Struct<{
        kind: Schema.Literal<["basic"]>;
    }>, Schema.Struct<{
        kind: Schema.Literal<["oauth2-bearer"]>;
    }>]>;
}>;
export type ProviderConnectionDraft = Schema.Schema.Type<typeof ProviderConnectionDraftSchema>;
/** Runtime-only credentials. `Redacted` keeps JSON/log output secret-safe. */
export declare const ProviderConnectionCredentialsSchema: Schema.Union<[Schema.Struct<{
    kind: Schema.Literal<["none"]>;
}>, Schema.Struct<{
    kind: Schema.Literal<["api-key"]>;
    apiKey: Schema.Redacted<typeof Schema.String>;
}>, Schema.Struct<{
    kind: Schema.Literal<["basic"]>;
    username: Schema.Redacted<typeof Schema.String>;
    password: Schema.Redacted<typeof Schema.String>;
}>, Schema.Struct<{
    kind: Schema.Literal<["oauth2-bearer"]>;
    accessToken: Schema.Redacted<typeof Schema.String>;
    refreshToken: Schema.optional<Schema.Redacted<typeof Schema.String>>;
}>]>;
export type ProviderConnectionCredentials = Schema.Schema.Type<typeof ProviderConnectionCredentialsSchema>;
export type ResolvedProviderConnection = {
    readonly source: 'saved';
    readonly connection: ProviderConnection;
    readonly credentials: ProviderConnectionCredentials;
    readonly credentialVersion: number;
    readonly expiresAt: Date | undefined;
} | {
    readonly source: 'legacy-environment';
    readonly connection: ProviderConnectionDraft;
    readonly credentials: ProviderConnectionCredentials;
};
export interface ProviderConnectionPrepareContext {
    readonly reload: () => Effect.Effect<ResolvedProviderConnection, ProviderConnectionError>;
    readonly compareAndSetCredentials: (credentials: ProviderConnectionCredentials, expectedVersion: number, expiresAt?: Date) => Effect.Effect<boolean, ProviderConnectionStoreError>;
}
export type ProviderConnectionPrepare = (resolved: ResolvedProviderConnection, context: ProviderConnectionPrepareContext) => Effect.Effect<ResolvedProviderConnection, Error>;
export type ProviderConnectionPrepareFactory = (config: ProviderConfig) => ProviderConnectionPrepare;
export interface ProviderConnectionCapabilities {
    readonly providerId: string;
    readonly auth: readonly ProviderConnectionAuthKind[];
    readonly login: readonly ProviderLoginMethod[];
    readonly protocols?: readonly ProviderConnectionProtocol[];
}
/** The documented baseline. Provider packages can declare a narrower override. */
export declare const BUILTIN_PROVIDER_CONNECTION_CAPABILITIES: readonly ProviderConnectionCapabilities[];
export declare const LOCAL_PROVIDER_CONNECTION_CAPABILITIES: ProviderConnectionCapabilities;
/** Resolve the concrete provider pack used by a hosted or local-compatible connection. */
export declare const providerConnectionRuntimeProviderId: (connection: ProviderConnection | ProviderConnectionDraft) => string | undefined;
declare const InvalidProviderConnectionIdError_base: Schema.TaggedErrorClass<InvalidProviderConnectionIdError, "InvalidProviderConnectionIdError", {
    readonly _tag: Schema.tag<"InvalidProviderConnectionIdError">;
} & {
    value: typeof Schema.String;
    message: typeof Schema.String;
}>;
export declare class InvalidProviderConnectionIdError extends InvalidProviderConnectionIdError_base {
}
declare const InvalidProviderConnectionNamespaceError_base: Schema.TaggedErrorClass<InvalidProviderConnectionNamespaceError, "InvalidProviderConnectionNamespaceError", {
    readonly _tag: Schema.tag<"InvalidProviderConnectionNamespaceError">;
} & {
    value: typeof Schema.String;
    message: typeof Schema.String;
}>;
export declare class InvalidProviderConnectionNamespaceError extends InvalidProviderConnectionNamespaceError_base {
}
declare const InvalidProviderConnectionEndpointError_base: Schema.TaggedErrorClass<InvalidProviderConnectionEndpointError, "InvalidProviderConnectionEndpointError", {
    readonly _tag: Schema.tag<"InvalidProviderConnectionEndpointError">;
} & {
    message: typeof Schema.String;
}>;
export declare class InvalidProviderConnectionEndpointError extends InvalidProviderConnectionEndpointError_base {
}
declare const ProviderConnectionNamespaceRequiredError_base: Schema.TaggedErrorClass<ProviderConnectionNamespaceRequiredError, "ProviderConnectionNamespaceRequiredError", {
    readonly _tag: Schema.tag<"ProviderConnectionNamespaceRequiredError">;
} & {
    connectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    message: typeof Schema.String;
}>;
export declare class ProviderConnectionNamespaceRequiredError extends ProviderConnectionNamespaceRequiredError_base {
}
declare const ProviderConnectionNotFoundError_base: Schema.TaggedErrorClass<ProviderConnectionNotFoundError, "ProviderConnectionNotFoundError", {
    readonly _tag: Schema.tag<"ProviderConnectionNotFoundError">;
} & {
    connectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    message: typeof Schema.String;
}>;
export declare class ProviderConnectionNotFoundError extends ProviderConnectionNotFoundError_base {
}
declare const ProviderConnectionProviderMismatchError_base: Schema.TaggedErrorClass<ProviderConnectionProviderMismatchError, "ProviderConnectionProviderMismatchError", {
    readonly _tag: Schema.tag<"ProviderConnectionProviderMismatchError">;
} & {
    connectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    expectedProviderId: typeof Schema.String;
    actualProviderId: typeof Schema.String;
    message: typeof Schema.String;
}>;
export declare class ProviderConnectionProviderMismatchError extends ProviderConnectionProviderMismatchError_base {
}
declare const ProviderConnectionDisabledError_base: Schema.TaggedErrorClass<ProviderConnectionDisabledError, "ProviderConnectionDisabledError", {
    readonly _tag: Schema.tag<"ProviderConnectionDisabledError">;
} & {
    connectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    message: typeof Schema.String;
}>;
export declare class ProviderConnectionDisabledError extends ProviderConnectionDisabledError_base {
}
declare const ProviderConnectionDeletedError_base: Schema.TaggedErrorClass<ProviderConnectionDeletedError, "ProviderConnectionDeletedError", {
    readonly _tag: Schema.tag<"ProviderConnectionDeletedError">;
} & {
    connectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    message: typeof Schema.String;
}>;
export declare class ProviderConnectionDeletedError extends ProviderConnectionDeletedError_base {
}
declare const UnsupportedProviderConnectionAuthError_base: Schema.TaggedErrorClass<UnsupportedProviderConnectionAuthError, "UnsupportedProviderConnectionAuthError", {
    readonly _tag: Schema.tag<"UnsupportedProviderConnectionAuthError">;
} & {
    providerId: typeof Schema.String;
    authKind: typeof Schema.String;
    message: typeof Schema.String;
}>;
export declare class UnsupportedProviderConnectionAuthError extends UnsupportedProviderConnectionAuthError_base {
}
declare const InvalidLocalProviderConnectionError_base: Schema.TaggedErrorClass<InvalidLocalProviderConnectionError, "InvalidLocalProviderConnectionError", {
    readonly _tag: Schema.tag<"InvalidLocalProviderConnectionError">;
} & {
    message: typeof Schema.String;
}>;
export declare class InvalidLocalProviderConnectionError extends InvalidLocalProviderConnectionError_base {
}
declare const UnsupportedProviderLoginMethodError_base: Schema.TaggedErrorClass<UnsupportedProviderLoginMethodError, "UnsupportedProviderLoginMethodError", {
    readonly _tag: Schema.tag<"UnsupportedProviderLoginMethodError">;
} & {
    providerId: typeof Schema.String;
    loginMethod: typeof Schema.String;
    message: typeof Schema.String;
}>;
export declare class UnsupportedProviderLoginMethodError extends UnsupportedProviderLoginMethodError_base {
}
declare const MalformedLegacyProviderEnvironmentError_base: Schema.TaggedErrorClass<MalformedLegacyProviderEnvironmentError, "MalformedLegacyProviderEnvironmentError", {
    readonly _tag: Schema.tag<"MalformedLegacyProviderEnvironmentError">;
} & {
    providerId: typeof Schema.String;
    variable: typeof Schema.String;
    message: typeof Schema.String;
}>;
export declare class MalformedLegacyProviderEnvironmentError extends MalformedLegacyProviderEnvironmentError_base {
}
declare const LegacyProviderConnectionNotConfiguredError_base: Schema.TaggedErrorClass<LegacyProviderConnectionNotConfiguredError, "LegacyProviderConnectionNotConfiguredError", {
    readonly _tag: Schema.tag<"LegacyProviderConnectionNotConfiguredError">;
} & {
    providerId: typeof Schema.String;
    message: typeof Schema.String;
}>;
export declare class LegacyProviderConnectionNotConfiguredError extends LegacyProviderConnectionNotConfiguredError_base {
}
declare const ProviderConnectionTestError_base: Schema.TaggedErrorClass<ProviderConnectionTestError, "ProviderConnectionTestError", {
    readonly _tag: Schema.tag<"ProviderConnectionTestError">;
} & {
    providerId: typeof Schema.String;
    reason: Schema.Literal<["configuration", "connectivity", "authentication", "timeout", "upstream"]>;
    statusCode: Schema.optional<typeof Schema.Number>;
    message: typeof Schema.String;
}>;
export declare class ProviderConnectionTestError extends ProviderConnectionTestError_base {
}
declare const ProviderConnectionPreparationRequiredError_base: Schema.TaggedErrorClass<ProviderConnectionPreparationRequiredError, "ProviderConnectionPreparationRequiredError", {
    readonly _tag: Schema.tag<"ProviderConnectionPreparationRequiredError">;
} & {
    providerId: typeof Schema.String;
    connectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    message: typeof Schema.String;
}>;
export declare class ProviderConnectionPreparationRequiredError extends ProviderConnectionPreparationRequiredError_base {
}
declare const ProviderConnectionStoreError_base: Schema.TaggedErrorClass<ProviderConnectionStoreError, "ProviderConnectionStoreError", {
    readonly _tag: Schema.tag<"ProviderConnectionStoreError">;
} & {
    operation: typeof Schema.String;
    message: typeof Schema.String;
}>;
/** A persistence implementation failed without exposing provider credentials. */
export declare class ProviderConnectionStoreError extends ProviderConnectionStoreError_base {
}
declare const ProviderConnectionIdentityChangeError_base: Schema.TaggedErrorClass<ProviderConnectionIdentityChangeError, "ProviderConnectionIdentityChangeError", {
    readonly _tag: Schema.tag<"ProviderConnectionIdentityChangeError">;
} & {
    connectionId: Schema.brand<typeof Schema.UUID, "@fred/ProviderConnectionId">;
    message: typeof Schema.String;
}>;
/** Metadata-only updates cannot change fields bound into the credential envelope. */
export declare class ProviderConnectionIdentityChangeError extends ProviderConnectionIdentityChangeError_base {
}
export type ProviderConnectionError = ProviderConnectionNotFoundError | ProviderConnectionProviderMismatchError | ProviderConnectionDisabledError | ProviderConnectionDeletedError | ProviderConnectionNamespaceRequiredError | UnsupportedProviderConnectionAuthError | UnsupportedProviderLoginMethodError | MalformedLegacyProviderEnvironmentError | LegacyProviderConnectionNotConfiguredError | ProviderConnectionPreparationRequiredError | ProviderConnectionIdentityChangeError | InvalidProviderConnectionEndpointError | ProviderConnectionStoreError;
/** Decode a raw ID at a trust boundary without leaking Effect parse details. */
export declare const decodeProviderConnectionId: (value: unknown) => Effect.Effect<ProviderConnectionId, InvalidProviderConnectionIdError>;
/** Decode a consumer-owned namespace at a trust boundary. */
export declare const decodeProviderConnectionNamespace: (value: unknown) => Effect.Effect<ProviderConnectionNamespace, InvalidProviderConnectionNamespaceError>;
/** Validate an optional provider endpoint at persistence and runtime boundaries. */
export declare const validateProviderConnectionEndpoint: (endpoint: string | undefined) => Effect.Effect<void, InvalidProviderConnectionEndpointError>;
/** Check an auth/login declaration before persisting or testing a connection. */
export declare const validateProviderConnectionCapability: (draft: ProviderConnectionDraft, capabilities: ProviderConnectionCapabilities, loginMethod?: ProviderLoginMethod) => Effect.Effect<void, InvalidLocalProviderConnectionError | UnsupportedProviderConnectionAuthError | UnsupportedProviderLoginMethodError>;
/** Provider-owned hook for testing an unsaved draft; persistence stays out of provider packages. */
export interface ProviderConnectionTestHook {
    readonly test: (draft: ProviderConnectionDraft, credentials: ProviderConnectionCredentials) => Effect.Effect<void, ProviderConnectionTestError>;
}
interface StoredProviderConnection {
    readonly connection: ProviderConnection;
    readonly credentials: ProviderConnectionCredentials;
    readonly credentialVersion?: number;
    readonly expiresAt?: Date;
}
/** Persistence boundary implemented by the Postgres package in Step 04. */
export interface ProviderConnectionStore {
    readonly list: (namespace: ProviderConnectionNamespace) => Effect.Effect<readonly ProviderConnection[], ProviderConnectionStoreError>;
    readonly get: (namespace: ProviderConnectionNamespace, id: ProviderConnectionId) => Effect.Effect<Option.Option<StoredProviderConnection>, ProviderConnectionStoreError>;
    readonly put: (namespace: ProviderConnectionNamespace, record: StoredProviderConnection) => Effect.Effect<void, ProviderConnectionStoreError>;
    readonly updateMetadata: (namespace: ProviderConnectionNamespace, connection: ProviderConnection) => Effect.Effect<boolean, ProviderConnectionIdentityChangeError | ProviderConnectionStoreError>;
    readonly compareAndSetCredentials: (namespace: ProviderConnectionNamespace, id: ProviderConnectionId, credentials: ProviderConnectionCredentials, expectedVersion: number, expiresAt?: Date) => Effect.Effect<boolean, ProviderConnectionStoreError>;
    readonly remove: (namespace: ProviderConnectionNamespace, id: ProviderConnectionId) => Effect.Effect<boolean, ProviderConnectionStoreError>;
}
export declare const ProviderConnectionStore: Context.Tag<ProviderConnectionStore, ProviderConnectionStore>;
/** Environment compatibility is injected; provider packages and this resolver never read it directly. */
export interface LegacyProviderConnectionResolver {
    readonly resolve: (providerId: string, apiKeyEnvVar?: string) => Effect.Effect<Option.Option<ResolvedProviderConnection>, MalformedLegacyProviderEnvironmentError>;
}
export declare const LegacyProviderConnectionResolver: Context.Tag<LegacyProviderConnectionResolver, LegacyProviderConnectionResolver>;
export interface ProviderConnectionService {
    readonly list: (namespace: ProviderConnectionNamespace) => Effect.Effect<readonly ProviderConnection[], ProviderConnectionStoreError>;
    readonly get: (namespace: ProviderConnectionNamespace, id: ProviderConnectionId) => Effect.Effect<Option.Option<ProviderConnection>, ProviderConnectionStoreError>;
    readonly put: (namespace: ProviderConnectionNamespace, connection: ProviderConnection, credentials: ProviderConnectionCredentials, expiresAt?: Date) => Effect.Effect<void, InvalidProviderConnectionEndpointError | ProviderConnectionStoreError>;
    readonly updateMetadata: (namespace: ProviderConnectionNamespace, connection: ProviderConnection) => Effect.Effect<boolean, InvalidProviderConnectionEndpointError | ProviderConnectionIdentityChangeError | ProviderConnectionStoreError>;
    readonly compareAndSetCredentials: ProviderConnectionStore['compareAndSetCredentials'];
    readonly remove: (namespace: ProviderConnectionNamespace, id: ProviderConnectionId) => Effect.Effect<boolean, ProviderConnectionStoreError>;
    readonly resolve: (request: {
        readonly providerId: string;
        readonly connectionId: ProviderConnectionId;
        readonly namespace: ProviderConnectionNamespace;
        readonly apiKeyEnvVar?: string;
    } | {
        readonly providerId: string;
        readonly connectionId?: undefined;
        readonly namespace?: undefined;
        readonly apiKeyEnvVar?: string;
    }) => Effect.Effect<ResolvedProviderConnection, ProviderConnectionError>;
}
export declare const ProviderConnectionService: Context.Tag<ProviderConnectionService, ProviderConnectionService>;
export declare const ProviderConnectionServiceLive: Layer.Layer<ProviderConnectionService, never, ProviderConnectionStore | LegacyProviderConnectionResolver>;
export declare const resolveProviderConnectionForUse: (service: ProviderConnectionService, provider: ProviderDefinition | undefined, request: Parameters<ProviderConnectionService["resolve"]>[0]) => Effect.Effect<ResolvedProviderConnection, Error>;
/** Build the compatibility adapter from a supplied environment snapshot. */
export declare const makeLegacyProviderConnectionResolver: (environment: Readonly<Record<string, string | undefined>>) => LegacyProviderConnectionResolver;
/** A mutable, no-I/O layer for unit tests and local composition. */
export declare const makeInMemoryProviderConnectionLayer: (records?: readonly (StoredProviderConnection & {
    readonly namespace: ProviderConnectionNamespace;
})[], legacy?: LegacyProviderConnectionResolver) => Layer.Layer<ProviderConnectionService>;
export {};
//# sourceMappingURL=connections.d.ts.map