import { AwsCredentialProviderError, Credentials, type ResolvedCredentials } from "@distilled.cloud/aws/Credentials";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import { AWSEnvironment } from "./Environment.ts";
export { Credentials, fromCredentials } from "@distilled.cloud/aws/Credentials";
declare module "@distilled.cloud/aws/Credentials" {
    interface Credentials {
        readonly kind: "Credentials";
    }
}
/**
 * Lazy `Credentials` layer derived from the surrounding {@link AWSEnvironment}.
 * Credentials are resolved on first access (not during layer construction),
 * matching the existing @distilled.cloud/aws semantics.
 */
export declare const fromEnvironment: Layer.Layer<Credentials, never, AWSEnvironment>;
/**
 * Build a single-flight, expiry-aware assumed-role credentials **resolver**,
 * constructing the cache (a `Ref` + a 1-permit refresh semaphore) exactly once.
 *
 * The OUTER effect builds the cache and returns the INNER resolver; run the
 * outer ONCE (e.g. when a binding initializes) and reuse the returned resolver
 * for every request. That is what makes the cache actually cache: each request
 * runs the shared resolver, which only calls `AssumeRole` when the cached
 * credentials are missing or within the refresh window — never per request.
 *
 * `roleArn` and `base` are accepted as effects/layers so the long-lived signing
 * credentials and role ARN can be read lazily at refresh time (e.g. from a
 * deployed Worker's environment), rather than captured eagerly.
 */
export declare const makeAssumeRoleResolver: (options: {
    /** ARN of the IAM Role to assume (resolved lazily on each refresh). */
    readonly roleArn: Effect.Effect<string>;
    /** Layer supplying the long-lived credentials used to sign `AssumeRole`. */
    readonly base: Layer.Layer<Credentials>;
    /** STS role session name. @default "alchemy-microvm" */
    readonly roleSessionName?: string;
    /**
     * Region for the STS endpoint. STS `AssumeRole` is global, so this only
     * selects the regional STS endpoint. @default "us-east-1"
     */
    readonly region?: string;
}) => Effect.Effect<Effect.Effect<ResolvedCredentials, AwsCredentialProviderError>>;
/**
 * A `Credentials` layer that assumes an IAM Role via STS and serves the
 * returned temporary credentials (cached until shortly before expiry).
 *
 * `base` supplies the long-lived credentials used to *sign* the `AssumeRole`
 * call — typically static IAM-user access keys (see
 * {@link fromCredentials}). The `AssumeRole` request itself is signed against
 * `base`, while the temporary credentials it returns become the resolved
 * `Credentials` for every downstream AWS call.
 *
 * The cache is built once when the layer is constructed; build/provide this
 * layer ONCE and reuse it. To share the same cache across many `Effect.provide`
 * sites without re-providing the layer, build {@link makeAssumeRoleResolver}
 * directly and supply the resolver via `Layer.succeed(Credentials, resolver)`.
 */
export declare const fromAssumeRole: (options: {
    /** ARN of the IAM Role to assume. */
    readonly roleArn: string;
    /** Static credentials used to sign the `AssumeRole` call. */
    readonly base: Layer.Layer<Credentials>;
    /** STS role session name. @default "alchemy-microvm" */
    readonly roleSessionName?: string;
    /**
     * Region for the STS endpoint. STS `AssumeRole` is global, so this only
     * selects the regional STS endpoint. @default "us-east-1"
     */
    readonly region?: string;
}) => Layer.Layer<Credentials>;
//# sourceMappingURL=Credentials.d.ts.map