/**
 * CP `POST /v1/oauth/token` response. No refresh token is issued for the
 * machine grants — re-mint when it expires.
 */
export interface OAuthToken {
    /** Project-scoped RS256 access token (`Authorization: Bearer …`). */
    access_token: string;
    /** Always `"Bearer"`. */
    token_type: string;
    /** Token lifetime in seconds. */
    expires_in: number;
    /** The granted (scope-capped) scope, when the CP returns one. */
    scope: string | null;
    /**
     * Data Plane API base URL for the token's project, resolved by the CP the
     * same way it is for the CLI login. `null` when the deployment can't be
     * resolved; the caller then needs an explicit DP URL. Hand this to the
     * browser client as `dpUrl` so the SPA connects without separate DP config.
     */
    dp_url: string | null;
}
export interface ServiceAccountTokenParams {
    /** Confidential Application client id (`intro_app_…`). */
    clientId: string;
    /** Confidential Application client secret (`intro_sk_…`). */
    clientSecret: string;
    /**
     * Project the token is scoped to. Required by the CP `client_credentials`
     * grant — the minted token is project-scoped and the project must belong to
     * the Application's organization.
     */
    project: string;
    /**
     * Optional space-separated scope. Capped server-side to the Application's
     * `allowed_scopes`; omit to receive the Application's default scope.
     */
    scope?: string;
    /**
     * CP API base URL. Defaults to `INTROSPECTION_BASE_API_URL` or
     * `https://api.introspection.dev`.
     */
    baseApiUrl?: string;
    /** Custom `fetch` (for tests or non-standard runtimes). */
    fetch?: typeof fetch;
}
/**
 * Back-compat alias: the `client_credentials` response is the same shape as
 * every other `/v1/oauth/token` response.
 */
export type ServiceAccountToken = OAuthToken;
/**
 * Mint a project-scoped CP access token from confidential service-account
 * credentials. See {@link ServiceAccountTokenParams}.
 *
 * @example
 * ```typescript
 * const { access_token, dp_url } = await serviceAccountToken({
 *   clientId: process.env.INTROSPECTION_SERVICE_ACCOUNT_CLIENT_ID!,
 *   clientSecret: process.env.INTROSPECTION_SERVICE_ACCOUNT_CLIENT_SECRET!,
 *   project: process.env.INTRO_PROJECT!,
 * });
 * const client = new IntrospectionClient({ token: access_token });
 * ```
 */
export declare function serviceAccountToken(params: ServiceAccountTokenParams): Promise<OAuthToken>;
export interface AuthorizationCodeParams {
    /** The authorization code returned to the redirect URI. */
    code: string;
    /** Public SPA Application `client_id` (PKCE — no secret). */
    clientId: string;
    /** The redirect URI the code was issued for (must match the authorize call). */
    redirectUri: string;
    /** The PKCE `code_verifier` paired with the authorize-step challenge. */
    codeVerifier: string;
    /**
     * CP API base URL. Defaults to `INTROSPECTION_BASE_API_URL` or
     * `https://api.introspection.dev`.
     */
    baseApiUrl?: string;
    /** Custom `fetch` (for tests or non-standard runtimes). */
    fetch?: typeof fetch;
}
/**
 * RFC 6749 / PKCE `authorization_code` exchange against CP
 * `POST /v1/oauth/token`. Run it in your backend so the browser hosted-login
 * flow does not hand-roll the token POST.
 */
export declare function authorizationCodeToken(params: AuthorizationCodeParams): Promise<OAuthToken>;
export interface TokenExchangeParams {
    /** The end user's subject token (e.g. a partner-IdP `id_token`). */
    subjectToken: string;
    /** The federated Application's `client_id` (public client — no secret). */
    clientId: string;
    /** Project the minted DP token is scoped to. */
    project: string;
    /**
     * The subject token's type URI. Defaults to
     * `urn:ietf:params:oauth:token-type:id_token`.
     */
    subjectTokenType?: string;
    /** Optional space-separated scope, capped server-side. */
    scope?: string;
    /**
     * CP API base URL. Defaults to `INTROSPECTION_BASE_API_URL` or
     * `https://api.introspection.dev`.
     */
    baseApiUrl?: string;
    /** Custom `fetch` (for tests or non-standard runtimes). */
    fetch?: typeof fetch;
}
/**
 * RFC 8693 token-exchange against CP `POST /v1/oauth/token`: trade an end
 * user's partner-IdP token for a project-scoped DP access token for a
 * `member_type=customer` member. Intended to run server-side in a broker (the
 * subject token shouldn't be re-handled in the browser longer than needed).
 *
 * @example
 * ```typescript
 * const { access_token, dp_url } = await tokenExchange({
 *   subjectToken: idTokenFromPartnerIdp,
 *   clientId: process.env.FEDERATED_CLIENT_ID!,
 *   project: process.env.INTRO_PROJECT!,
 * });
 * ```
 */
export declare function tokenExchange(params: TokenExchangeParams): Promise<OAuthToken>;
//# sourceMappingURL=auth.d.ts.map