/**
 * A fixed "now" timestamp used by token-endpoint tests that need
 * determinism for `expiresAt` assertions. Any constant would do;
 * choosing one value keeps the arithmetic trivial to eyeball
 * (2023-11-14T22:13:20.000Z).
 */
export declare const FIXED_NOW = 1700000000000;
/** Signature matching the global `fetch` implementation. */
export type FetchMock = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
/**
 * Swaps `globalThis.fetch` for `mock` while `fn` runs, then restores.
 * Use in tests that mock *every* fetch the subject under test makes.
 * (Tests that want pass-through-on-miss behavior should keep their
 * own router — see `authorize.test.ts`.)
 */
export declare function withFetch(mock: FetchMock, fn: () => Promise<void>): Promise<void>;
/**
 * JSON-serialized `Response` with `Content-Type: application/json`
 * already set. Any headers in `init.headers` merge on top.
 */
export declare function jsonResponse(body: unknown, init?: ResponseInit): Response;
/**
 * Canonical local Keycloak issuer URL used across tests — matches
 * walnut's dev setup (`http://localhost:8080/auth/realms/local`).
 * Use this anywhere a test needs "the Keycloak issuer" rather than
 * a test-specific URL (e.g. `http://auth.test.invalid`).
 */
export declare const KEYCLOAK_ISSUER = "http://localhost:8080/auth/realms/local";
/**
 * Standard OAuth 2.0 token-endpoint success body. Returns a fresh
 * plain object on each call so tests can safely mutate it after.
 * Override any field via `overrides`; the happy-path defaults
 * (Bearer, positive `expires_in`) are what most tests want.
 */
export declare function tokenResponseBody(overrides?: Record<string, unknown>): Record<string, unknown>;