/**
 * Ensures a confidential service-account client exists in the tenant realm.
 * Returns the client secret when a new client is created; returns null when
 * the client already existed or the operation could not be completed.
 */
export declare function ensureServiceClient(accessServiceUrl: string, realm: string, clientId: string, accessToken: string | undefined): Promise<string | null>;
/**
 * Ensures a public (browser-based) client exists in the tenant realm.
 * No-ops if the client already exists.
 * Uses http://localhost:4200/* as the default redirect URI for local development;
 * add production URIs via the ADSP admin portal after deployment.
 */
export declare function ensurePublicClient(accessServiceUrl: string, realm: string, clientId: string, accessToken: string | undefined): Promise<void>;
/**
 * Ensures the frontend (public) client has a protocol mapper that includes the
 * backend service client ID in the `aud` claim of issued access tokens.
 * Required so the backend can validate tokens obtained via the frontend login.
 */
export declare function ensureAudienceMapper(accessServiceUrl: string, realm: string, frontendClientId: string, backendClientId: string, accessToken: string | undefined): Promise<void>;
/**
 * Adds a backend client role to the frontend client's scope so that users with
 * the role have it included in tokens issued via the frontend, and Keycloak
 * includes the backend client in the `aud` claim for those users.
 * Used alongside ensureAudienceMapper: the mapper covers all authenticated users,
 * the scope mapping wires up the RBAC demo for users assigned the role.
 */
export declare function ensureClientRoleScope(accessServiceUrl: string, realm: string, frontendClientId: string, backendClientId: string, roleName: string, accessToken: string | undefined): Promise<void>;