import type { FabricPrincipal } from "@fabric-harness/sdk";
import { type Credentials } from "@databricks/sdk-auth";
/**
 * A bearer-token resolver awaited per request. Fabric uses the same native-SDK credential across
 * generated service clients, model calls, preview streaming, and Lakebase credential exchange.
 */
export type DatabricksTokenProvider = () => Promise<string>;
export type DatabricksPrincipal = 
/** Personal access token. Dev / single-user only. */
{
    kind: "pat";
    token: string;
    label?: string;
}
/** OAuth machine-to-machine (client-credentials). The agent acts as one governed identity. */
 | {
    kind: "service-principal";
    host: string;
    clientId: string;
    clientSecret: string;
    /** OAuth scope; defaults to `all-apis`. */
    scope?: string;
    /** Refresh this many seconds before expiry to avoid using a token that expires mid-flight. Default 60. */
    refreshSkewSeconds?: number;
}
/**
 * On-behalf-of a specific end user. The caller binds the user's token resolver (e.g. from a
 * channel `actor`), so Unity Catalog enforces *that human's* grants. The resolver is responsible
 * for its own caching/refresh.
 */
 | {
    kind: "on-behalf-of";
    userToken: () => string | Promise<string>;
    label?: string;
} | {
    /**
     * Local developer identity resolved by the Databricks CLI OAuth cache.
     * When `host` is omitted, the workspace host is resolved from the named
     * CLI profile (`~/.databrickscfg` / `DATABRICKS_CONFIG_FILE`). An
     * explicit `host` takes precedence as the workspace origin used for API
     * calls, but CLI token acquisition always follows the named profile
     * (`databricks auth token --profile <name>`, no host argument) — `host`
     * and the profile must point at the same workspace.
     */
    kind: "cli-profile";
    host?: string;
    profile?: string;
};
export interface DatabricksPrincipalEnvOptions {
    /** PAT variable name. Default `DATABRICKS_TOKEN`. */
    tokenEnv?: string;
    /** OAuth client id variable name. Default `DATABRICKS_CLIENT_ID`. */
    clientIdEnv?: string;
    /** OAuth client secret variable name. Default `DATABRICKS_CLIENT_SECRET`. */
    clientSecretEnv?: string;
    /** Workspace host variable name. Default `DATABRICKS_HOST`. */
    hostEnv?: string;
    /** Databricks CLI profile variable name. Default `DATABRICKS_CONFIG_PROFILE`. */
    profileEnv?: string;
}
/** Native Databricks SDK credentials for a governed Fabric principal. */
export declare function databricksCredentials(principal: DatabricksPrincipal): Credentials;
export declare function databricksCredentialsFromTokenProvider(provider: DatabricksTokenProvider, name?: string): Credentials;
/** Builds a rotating bearer-token provider from the same native credential used by SDK clients. */
export declare function databricksIdentity(principal: DatabricksPrincipal): DatabricksTokenProvider;
/** Resolve a PAT or OAuth M2M principal consistently across CLIs, recipes, Apps, and tests. */
export declare function databricksPrincipalFromEnv(env?: Record<string, string | undefined>, options?: DatabricksPrincipalEnvOptions): Extract<DatabricksPrincipal, {
    kind: "pat" | "service-principal" | "cli-profile";
}>;
/**
 * Workspace host resolved from a Databricks CLI profile (`~/.databrickscfg` or
 * `DATABRICKS_CONFIG_FILE`), normalized to the workspace origin. `DATABRICKS_*`
 * environment variables overlay the file per the official SDK credential chain.
 */
export declare function databricksHostFromCliProfile(profile?: string): Promise<string>;
/**
 * The service principal a Databricks App runs as, from the standard app
 * runtime environment (`DATABRICKS_HOST` / `DATABRICKS_CLIENT_ID` /
 * `DATABRICKS_CLIENT_SECRET`). Returns `undefined` when any variable is
 * missing, so callers can fall back to explicit configuration.
 */
export declare function appServicePrincipalFromEnv(env?: Record<string, string | undefined>): Extract<DatabricksPrincipal, {
    kind: "service-principal";
}> | undefined;
/**
 * On-behalf-of principal from Databricks Apps user-authorization headers:
 * the platform forwards the signed-in user's access token as
 * `x-forwarded-access-token` (plus `x-forwarded-email`/`x-forwarded-user`).
 * Returns `undefined` when the request carries no user token (e.g. app
 * service-to-service traffic) so callers fall back to the app principal.
 */
export declare function onBehalfOfFromHeaders(headers: Headers | Record<string, string | string[] | undefined>): Extract<DatabricksPrincipal, {
    kind: "on-behalf-of";
}> | undefined;
export interface FabricPrincipalOverrides {
    id?: string;
    /** Unity Catalog principal name, when it differs from the id. */
    ucPrincipal?: string;
    displayName?: string;
    /** Mark a service principal as the hosting app's own identity. */
    asAppPrincipal?: boolean;
}
/**
 * Map a Databricks principal onto the SDK's {@link FabricPrincipal} so the
 * governed identity rides submissions → tool calls → lineage/cost records.
 * Never carries a token — ids and labels only.
 */
export declare function fabricPrincipalFor(principal: DatabricksPrincipal, overrides?: FabricPrincipalOverrides): FabricPrincipal;
//# sourceMappingURL=identity.d.ts.map