import type { SitecoreApiClientOptions } from "../auth/index.js";
/**
 * OAuth scopes the Content Operations Brief API requires.
 *
 * Discovered 2026-05-14 by probing the Agents env M2M client:
 *   - `co.briefs:r` — read briefs, brief types, tasks, comments
 *   - `co.briefs:w` — create/update/delete briefs, post tasks/comments
 *
 * The Agents env automation client carries both by default — minting
 * a token with no `scope` parameter still includes `co.briefs:r/w` in
 * the granted claim. Requesting the scopes explicitly is the
 * least-privilege path and the one used here.
 */
export declare const BRIEF_SCOPES_REQUESTED: readonly ["co.briefs:r", "co.briefs:w"];
export interface AcquireBriefTokenOptions {
    /**
     * Sitecore organization id — the Brief API is org-scoped, so the
     * minted token is cached under `brief:<orgId>` in the OS keychain.
     */
    orgId: string;
    /**
     * Credential-bearing options used to mint the token: the matched env
     * profile's client metadata (when one exists — `name`, `clientId`,
     * `automationClient`, `authority`) plus `organizationId` / `orgClientId`,
     * so the three-tier credential chain can resolve a usable client.
     */
    environment: SitecoreApiClientOptions;
}
/**
 * Returns a Bearer JWT for the Sitecore Content Operations Brief API.
 *
 * Resolution order:
 *   1. Brief-specific keychain entry, if still valid (JWT not expired).
 *   2. M2M client-credentials mint with `co.briefs:r co.briefs:w`. The
 *      `clientId` + `clientSecret` are resolved by `resolveClientCredential`
 *      — the shared three-tier chain: the
 *      `SITECOREAI_ENV_<ENV>_CLIENT_SECRET` env-var override, then the
 *      env-scoped automation client in the OS keychain, then the
 *      org-scoped one. Result is cached.
 *
 * Refuses with `AUTH_REQUIRED` if neither path yields a token. There
 * is no interactive login flow — Brief calls are always agent-driven.
 *
 * The cache → resolve → mint → cache loop is implemented by the shared
 * `createApiAuth` factory in `@/auth/factory`; brief plugs in its own
 * keychain slot, scope-request string, error hints, and credential
 * resolver (the three-tier chain, gated on `env.authority` so a
 * profile with no authority falls into the missing-credential branch).
 */
export declare const acquireBriefToken: (options: AcquireBriefTokenOptions) => Promise<string>;