import type { HttpMethod } from "../../contracts/common.js";
import { type M2MCallerMode, type ServiceTokenClaims } from "../../contracts/m2m.js";
import type { ScopedM2MConfig } from "../../contracts/controlPlane.js";
import type { RsaKeyPair } from "./keypair.js";
export interface SignServiceTokenOptions {
    readonly keyPair: RsaKeyPair;
    readonly sourceServiceId: string;
    readonly targetServiceId: string;
    readonly tenantId: string;
    readonly appId: string;
    readonly bindingId: string;
    readonly expiresInSeconds?: number;
}
export interface AuthorizeServiceTokenOptions {
    readonly policy: ScopedM2MConfig;
    readonly tenantId: string;
    readonly appId: string;
    readonly viewId: string;
    readonly method: HttpMethod;
    readonly mode: M2MCallerMode;
    readonly sourceServiceId: string;
    readonly requiredPermissions?: ReadonlyArray<string>;
    readonly clockToleranceSeconds?: number;
}
export interface AuthorizedServiceCaller {
    readonly claims: ServiceTokenClaims;
    readonly permissions: ReadonlyArray<string>;
}
export declare class ServiceTokenAuthorizationError extends Error {
    readonly status: 401 | 403;
    constructor(message: string, status: 401 | 403);
}
export declare function signServiceToken(options: SignServiceTokenOptions): string;
export declare function isServiceToken(token: string): boolean;
export declare function authorizeServiceToken(token: string, options: AuthorizeServiceTokenOptions): Promise<AuthorizedServiceCaller>;
//# sourceMappingURL=serviceToken.d.ts.map