/**
 * OAuth token introspection client (RF-RMT11 / RF-RMT26 consumer side).
 *
 * The remote transport never validates tokens itself: it resolves the incoming
 * `Authorization: Bearer` token against the API's internal introspection
 * endpoint (service-to-service, `X-Internal-Key`, Docker network only). The API
 * caches positive lookups in Redis (~60s) so revocation propagates in ≤60s
 * without this process holding any per-replica state.
 *
 * The resolved api_key is held per-request only and never logged or echoed.
 */
export interface IntrospectionResult {
    active: boolean;
    /** Site the user authorized in the consent screen (one site per connection, D-2). */
    account_id?: string;
    /** OAuth scopes granted (e.g. ["analytics:read"]). */
    scopes?: string[];
    /** Server-side read-only api_key the tools use against the public API. */
    api_key?: string;
    client_id?: string;
}
export declare class IntrospectionError extends Error {
    /** True when the API was unreachable/5xx — surface as 503, not 401. */
    readonly unavailable: boolean;
    constructor(message: string, 
    /** True when the API was unreachable/5xx — surface as 503, not 401. */
    unavailable?: boolean);
}
export interface IntrospectorOptions {
    /** Internal endpoint, e.g. http://api-1:8000/api/v1/internal/oauth/introspect */
    url: string;
    internalKey: string;
    fetchImpl?: typeof fetch;
}
export declare class Introspector {
    private readonly url;
    private readonly internalKey;
    private readonly fetchImpl;
    constructor(opts: IntrospectorOptions);
    introspect(token: string): Promise<IntrospectionResult>;
}
//# sourceMappingURL=introspect.d.ts.map