import * as Effect from "effect/Effect";
declare const OAuthError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "OAuthError";
} & Readonly<A>;
export declare class OAuthError extends OAuthError_base<{
    error: string;
    errorDescription: string;
}> {
}
export interface OAuthCredentials {
    type: "oauth";
    access: string;
    refresh: string;
    expires: number;
    scopes: string[];
}
export interface Authorization {
    url: string;
    state: string;
}
/**
 * Registered PlanetScale OAuth application credentials.
 *
 * Unlike Cloudflare, PlanetScale OAuth has **no public-client flow** — the
 * token endpoint requires client authentication for every grant (PKCE is
 * advertised in their discovery doc but does not lift that requirement), so
 * exchanging the authorization code (and refreshing the token) requires the
 * application's `client_secret`. There is no way to keep that secret out of
 * a distributed CLI, so it ships here: the exposure is the same posture as a
 * public `client_id` (a stolen refresh token is usable, exactly like
 * Cloudflare's secret-less refresh), and it can be rotated by cutting a new
 * release. PlanetScale's own CLI ships its OAuth `client_secret` in source
 * the same way:
 * https://github.com/planetscale/cli/blob/main/internal/auth/authenticator.go
 *
 * Registered at https://app.planetscale.com with redirect URI
 * {@link OAUTH_REDIRECT_URI}. Scopes are configured on the application
 * itself, not requested per-authorization. Rotate by registering a new
 * secret and cutting a release.
 */
export declare const OAUTH_CLIENT_ID = "pscale_app_aa12e3938baebb788aac443f66e422da";
export declare const OAUTH_CLIENT_SECRET = "pscale_app_secret_yyZ3Q8oe99GP9_yA5wrA5er6RuN6Lz9dC66Bj1OJzpg";
export declare const OAUTH_REDIRECT_URI = "https://alchemy.run/auth/callback";
export declare const OAUTH_LOCAL_CALLBACK_URI = "http://localhost:9976/auth/callback";
export declare const OAUTH_ENDPOINTS: {
    authorize: string;
    token: string;
};
/**
 * Generate a PlanetScale authorization URL.
 *
 * No `scope` parameter is sent: PlanetScale scopes are configured on the
 * OAuth application itself, not requested per-authorization, so the
 * consent screen shows whatever the app is registered with.
 */
export declare function authorize(): Authorization;
/**
 * Exchange an authorization code for OAuth credentials.
 */
export declare const exchange: (code: string) => Effect.Effect<OAuthCredentials, OAuthError>;
/**
 * Refresh expired OAuth credentials.
 */
export declare const refresh: (credentials: OAuthCredentials) => Effect.Effect<OAuthCredentials, OAuthError>;
/**
 * Exchange a code copied from the hosted relay page, or extract the code from
 * either the hosted or loopback callback URL.
 */
export declare const exchangeCallbackInput: (input: string, authorization: Authorization) => Effect.Effect<OAuthCredentials, OAuthError>;
/**
 * Start a local HTTP server to listen for the OAuth callback, exchange
 * the authorization code, and return the credentials.
 *
 * Times out after 5 minutes.
 */
export declare const callback: (authorization: Authorization) => Effect.Effect<OAuthCredentials, OAuthError>;
export {};
//# sourceMappingURL=OAuthClient.d.ts.map