import type { SitecoreApiClientOptions } from "../../auth/index.js";
/**
 * OAuth scopes the SAI Publishing API requires.
 *
 * Per the Publishing API architect (2026-05-14):
 *
 *   - Every Sitecore Cloud **environment** has its own automation
 *     client (Cloud Portal → Environments → [env] → Automation
 *     Clients). Env-level clients carry the tenant-tier `.t` scopes
 *     below by default. ORG-level clients (used for org/project/env
 *     management) do NOT.
 *   - The api-docs page lists both `.a` (admin-tier, for Pages-UI
 *     user tokens with Organization Owner role) and `.t` (tenant-
 *     tier, for automation clients). Use `.t` for any flow whose
 *     credentials are scoped to a single environment.
 *
 *   - `xmcpub.jobs.t:r` — read publishing jobs
 *   - `xmcpub.jobs.t:w` — create / cancel publishing jobs
 *   - `xmcpub.queue:r`  — read the publish queue
 *
 * Audience: `https://api.sitecorecloud.io` (standard).
 */
export declare const PUBLISHING_SCOPES_REQUESTED: readonly ["xmcpub.jobs.t:r", "xmcpub.jobs.t:w", "xmcpub.queue:r"];
export interface AcquirePublishingTokenOptions {
    envName: string;
    environment: SitecoreApiClientOptions;
}
/**
 * Returns a Bearer JWT for the SAI Publishing API.
 *
 * Resolution order, cheapest first:
 *
 *   1. Cached publishing token in the keychain — set by a previous
 *      successful mint via this function. Reused until expiry / clear.
 *   2. The deploy token in the keychain, IF its scope claim already
 *      includes `xmcpub.jobs.t:*`. This is the zero-config path:
 *      operators who logged in interactively against an env-level
 *      automation client get a single token covering both deploy
 *      and publishing scopes (scai's default scope set requests
 *      both — see `SCAI_API_SCOPES`).
 *   3. Fresh M2M mint via the env's `clientId` + `clientSecret`,
 *      explicitly requesting publishing scopes. Cached on success.
 *
 * Refuses with `AUTH_REQUIRED` when none of these paths produces a
 * token carrying the required scopes. The error message decodes the
 * granted-scope set and infers the credential class so operators know
 * whether they need an env-level client or just need to re-login.
 */
export declare const acquirePublishingToken: (options: AcquirePublishingTokenOptions) => Promise<string>;