import type * as Credentials from "@distilled.cloud/aws/Credentials";
import type * as Region from "@distilled.cloud/aws/Region";
import * as Duration from "effect/Duration";
import * as Effect from "effect/Effect";
import * as Redacted from "effect/Redacted";
export interface GenerateDbAuthTokenOptions {
    /**
     * SigV4 signing service name: `rds-db` for RDS/Aurora IAM database
     * authentication, `dsql` for Aurora DSQL.
     */
    service: "rds-db" | "dsql";
    /** Database endpoint hostname the token authorizes a connection to. */
    hostname: string;
    /**
     * Database endpoint port. Signed into the token for `rds-db` (the RDS
     * signer scopes tokens to `host:port`); DSQL tokens are host-only.
     */
    port?: number;
    /** Database user (`rds-db` only — signed as the `DBUser` parameter). */
    username?: string;
    /**
     * DSQL connect action (`dsql` only).
     * @default "DbConnect"
     */
    action?: "DbConnect" | "DbConnectAdmin";
    /**
     * How long the token remains valid.
     * @default 15 minutes
     */
    expiresIn?: Duration.Input;
    /** SigV4 signing region. Defaults to the ambient `Region` service. */
    region?: string;
}
/**
 * Generate a short-lived IAM database authentication token.
 *
 * This is a pure client-side SigV4 *presign* — no AWS API call is made
 * (there is no distilled operation for it). The token is the presigned URL
 * with the `https://` scheme stripped, exactly what the `rds-db` and `dsql`
 * data planes expect as the connection password. It inherits the IAM
 * permissions of the identity resolved from the ambient distilled
 * `Credentials` service (`rds-db:connect` on the DB user resource for RDS,
 * `dsql:DbConnect`/`dsql:DbConnectAdmin` on the cluster for DSQL).
 *
 * Because per-execution pools re-run their build on the first query of each
 * execution (see `Runtime/ExecutionMemo.ts`), minting inside a pool build
 * means a token can never outlive its pool on workerd or Lambda.
 */
export declare const generateDbAuthToken: (options: GenerateDbAuthTokenOptions) => Effect.Effect<Redacted.Redacted<string>, Credentials.CredentialsError, Credentials.Credentials | Region.Region>;
//# sourceMappingURL=DbAuthToken.d.ts.map