import { Project, Projects } from '@owox/idp-protocol';
import { IdentityOwoxClientConfig } from '../config/idp-owox-config.js';
import { AuthFlowRequest, AuthFlowResponse, GoogleIdentityExchangeRequest, IntrospectionRequest, IntrospectionResponse, JwksResponse, McpOAuthAuthorizationCodeRequest, McpOAuthAuthorizationCodeResponse, McpOAuthTokenExchangeRequest, McpOAuthTokenExchangeResponse, McpOAuthTokenVerificationRequest, OwoxApproveMembershipRequestResponse, OwoxInviteProjectMemberResponse, OwoxListMembershipRequestsResponse, OwoxProjectMembersResponse, ProjectMemberApiKeyAuthFlowRequest, PluginRuntimeAuthFlowRequest, PluginRuntimeAuthFlowResponse, OwoxCreateNewProjectResponse, OwoxRequestProjectAccessResponse, OwoxUpdateUserProvisioningSettingsRequest, OwoxUserProvisioningRequestAccessContextResponse, OwoxUserProvisioningSettingsResponse, RevocationRequest, RevocationResponse, TokenRequest, TokenResponse } from './dto/index.js';
/**
 * Represents a client for interacting with the Identity OWOX API.
 * Provides methods for token management, validation, and retrieval of key sets.
 */
export declare class IdentityOwoxClient {
    private readonly http;
    private readonly impersonatedIdTokenFetcher?;
    private readonly c2cServiceAccountEmail?;
    private readonly c2cTargetAudience?;
    private readonly clientBackchannelPrefix;
    constructor(config: IdentityOwoxClientConfig);
    /**
     * POST /api/idp/token
     */
    getToken(req: TokenRequest): Promise<TokenResponse>;
    /**
     * POST auth-flow/extension/identity
     */
    exchangeGoogleIdentityToken(req: GoogleIdentityExchangeRequest): Promise<TokenResponse>;
    /**
     * POST /idp/auth-flow/project-member-api-key
     */
    issueAccessTokenForProjectMemberApiKey(req: ProjectMemberApiKeyAuthFlowRequest): Promise<TokenResponse>;
    /**
     * POST /idp/auth-flow/plugin-runtime
     */
    issueAccessTokenForPluginRuntime(req: PluginRuntimeAuthFlowRequest): Promise<PluginRuntimeAuthFlowResponse>;
    /**
     * POST /idp/oauth/authorization-code.
     */
    createMcpOAuthAuthorizationCode(req: McpOAuthAuthorizationCodeRequest): Promise<McpOAuthAuthorizationCodeResponse>;
    /**
     * POST /idp/oauth/token.
     */
    exchangeMcpOAuthToken(req: McpOAuthTokenExchangeRequest): Promise<McpOAuthTokenExchangeResponse>;
    /**
     * POST /idp/oauth/token/verify.
     */
    verifyMcpAccessToken(req: McpOAuthTokenVerificationRequest): Promise<{
        userId: string;
        projectId: string;
        roles: ("admin" | "editor" | "viewer")[];
        authFlow: "mcp";
        resource: string;
        clientId: string;
        scopes: ("mcp:read" | "mcp:write")[];
        email?: string | undefined;
        fullName?: string | undefined;
        avatar?: string | undefined;
    } | null>;
    /**
     * POST /api/idp/revocation
     */
    revokeToken(req: RevocationRequest): Promise<RevocationResponse>;
    /**
     * GET /api/idp/introspection
     */
    introspectToken(req: IntrospectionRequest): Promise<IntrospectionResponse>;
    /**
     * GET /api/idp/projects
     */
    getProjects(accessToken: string): Promise<Projects>;
    /**
     * GET one project for a user via C2C (component-to-component) authentication.
     */
    getProjectForUser(userId: string, projectId: string): Promise<Project>;
    /**
     * GET /api/idp/.well-known/jwks.json
     */
    getJwks(): Promise<JwksResponse>;
    /**
     * Completes auth flow by exchanging user info for a one-time authorization code.
     * Requires service account authentication for the private internal endpoint.
     */
    completeAuthFlow(request: AuthFlowRequest): Promise<AuthFlowResponse>;
    /**
     * GET project members via C2C (component-to-component) authentication.
     */
    getProjectMembers(projectId: string): Promise<OwoxProjectMembersResponse>;
    /**
     * POST /idp/bi-project/:projectId/members — invite a new member by email.
     *
     * The Java endpoint owns validation, duplicate detection, email delivery and
     * pending-user provisioning. It returns the resolved userUid (new or
     * pre-existing) so callers can attach authorization scope immediately.
     *
     * Path mirrors the existing `getProjectMembers` (GET on the same collection)
     * on the C2C backchannel — the public `/api/idp/projects/...` variant is
     * user-JWT authed and not reachable from this service-to-service client.
     */
    inviteProjectMember(projectId: string, email: string, role: string, actorUserId: string): Promise<OwoxInviteProjectMemberResponse>;
    /**
     * DELETE /idp/bi-project/:projectId/members/:userId — remove a member.
     * See `inviteProjectMember` for path rationale.
     */
    removeProjectMember(projectId: string, userId: string, actorUserId: string): Promise<void>;
    /**
     * PUT /idp/bi-project/:projectId/members/:userId/role — change a member's role.
     * See `inviteProjectMember` for path rationale.
     */
    changeProjectMemberRole(projectId: string, userId: string, newRole: string, actorUserId: string): Promise<void>;
    /**
     * GET /idp/bi-project/:projectId/user-provisioning-settings.
     * See `inviteProjectMember` for C2C backchannel rationale.
     */
    getUserProvisioningSettings(projectId: string, actorUserId: string): Promise<OwoxUserProvisioningSettingsResponse>;
    /**
     * PUT /idp/bi-project/:projectId/user-provisioning-settings.
     * See `inviteProjectMember` for C2C backchannel rationale.
     */
    updateUserProvisioningSettings(projectId: string, actorUserId: string, settings: OwoxUpdateUserProvisioningSettingsRequest): Promise<OwoxUserProvisioningSettingsResponse>;
    /**
     * GET /idp/bi-project/:projectId/membership-requests — list pending requests.
     *
     * `actorUserId` is forwarded as the `biUserId` query parameter as required
     * by the Java contract.
     */
    listProjectMembershipRequests(projectId: string, actorUserId: string): Promise<OwoxListMembershipRequestsResponse>;
    /**
     * POST /idp/bi-project/:projectId/membership-requests/:requestId/approve.
     *
     * Response: 200 OK with body `{ userUid: string }` — the resolved user uid
     * of the approved requester. `MembershipRequestsService` maps `userUid → userId`
     * on `ApproveMembershipRequestResult`.
     */
    approveProjectMembershipRequest(projectId: string, requestId: string, role: string, actorUserId: string): Promise<OwoxApproveMembershipRequestResponse>;
    /**
     * POST /idp/bi-project/:projectId/membership-requests/:requestId/decline.
     * See `listProjectMembershipRequests` for wiring status.
     */
    declineProjectMembershipRequest(projectId: string, requestId: string, actorUserId: string): Promise<void>;
    /**
     * GET /idp/bi-project/:projectId/user-provisioning/request-access-context.
     */
    getUserProvisioningRequestAccessContext(userUid: string, projectId: string): Promise<OwoxUserProvisioningRequestAccessContextResponse>;
    /**
     * POST /idp/bi-project/:projectId/user-provisioning/request-access.
     */
    requestProjectAccess(userUid: string, projectId: string, role: string): Promise<OwoxRequestProjectAccessResponse>;
    /**
     * POST /idp/user-provisioning/create-new-project.
     */
    createNewProject(userUid: string, integration: string): Promise<OwoxCreateNewProjectResponse>;
    /**
     * Validate the C2C configuration and mint an `Authorization` header for a
     * single backchannel call. Used by every method that hits the OWOX Identity
     * service over service-to-service auth — keeps the preflight (check + token
     * fetch) in one place so future additions to the C2C config surface in one
     * spot, not nine.
     */
    private getC2cAuthHeader;
    private handleAxiosError;
}
//# sourceMappingURL=IdentityOwoxClient.d.ts.map