import type { IncomingMessage } from 'node:http';
import type { Authenticator, AuthResult } from './Authenticator';
/**
 * Cache keys bind the issuer and complete credentials, without storing secrets in keys.
 */
export interface TokenCache {
    get(credentialKey: string): Promise<{
        token: string;
        tokenType?: 'Bearer' | 'DPoP';
        webId: string;
        expiresAt: Date;
    } | undefined>;
    set(credentialKey: string, token: string, webId: string, expiresAt: Date, tokenType?: 'Bearer' | 'DPoP'): Promise<void>;
}
export interface ClientCredentialsAuthenticatorOptions {
    tokenCache?: TokenCache;
    /**
     * CSS token endpoint URL
     */
    tokenEndpoint: string;
    /** Canonical CSS URL represented by an internal token endpoint. */
    publicBaseUrl?: string;
}
/**
 * Authenticator for CSS client credentials wrapped in sk-xxx transport format.
 *
 * Format: sk-base64(client_id:client_secret)
 *
 * This authenticator:
 * 1. Decodes the wrapper to get client_id and client_secret
 * 2. Exchanges them for a Solid Token via CSS token endpoint
 * 3. Extracts webId from the token response
 * 4. Returns a SolidAuthContext
 */
export declare class ClientCredentialsAuthenticator implements Authenticator {
    private readonly logger;
    private readonly tokenCache?;
    private readonly tokenEndpoint;
    private readonly tokenEndpointHeaders;
    private readonly tokenEndpointProofUrl;
    constructor(options: ClientCredentialsAuthenticatorOptions);
    canAuthenticate(request: IncomingMessage): boolean;
    authenticate(request: IncomingMessage): Promise<AuthResult>;
    private exchangeForToken;
}