import { type BuildClientAssertionJwtInput } from 'gdc-common-utils-ts/utils/client-assertion';
import type { SmartTokenRequestContract } from 'gdc-sdk-core-ts';
import type { PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
import type { RouteContext } from './individual-onboarding.js';
/**
 * Public SDK input for GW SMART/OpenID token requests.
 *
 * Separation of concerns:
 * - actor identity is carried by `actorDid`
 * - subject access is carried by `subjectDid` plus requested `scopes`
 * - tenant/jurisdiction/sector are only route hints
 *   for the current GW transport contract when the client does not already
 *   have a default route context configured
 *
 * Why this route context still exists:
 * the current CORE GW token endpoint is tenant-scoped in the URL itself, for
 * example:
 * `/{tenantId}/cds-{jurisdiction}/v1/{sector}/identity/openid/smart/token`
 *
 * So the route context selects which gateway tenant, consent store, and token
 * issuer is answering the request. It is not the same thing as the actor DID
 * carried inside the request body as `sub`.
 *
 * Current implementation status:
 * - actor DID, subject DID, and client/device identity are separated at input level
 * - the runtime still depends on tenant-scoped GW URLs
 *
 * Pending convergence work:
 * - resolve token endpoints from provider DID documents / discovery metadata
 * - avoid route-context fallback when resolved provider metadata is already available
 *
 * Canonical payload examples for both token-exchange and OpenID4VP SMART flows
 * live in `gdc-common-utils-ts/examples`.
 */
export type SmartTokenRequestInput = SmartTokenRequestContract & {
    /**
     * @deprecated Prefer configuring `NodeHttpClient({ ctx })`.
     */
    tenantId?: string;
    /**
     * @deprecated Prefer configuring `NodeHttpClient({ ctx })`.
     */
    jurisdiction?: string;
    /**
     * @deprecated Prefer configuring `NodeHttpClient({ ctx })`.
     */
    sector?: string;
    /**
     * OpenID token or subject token already obtained by the caller.
     */
    /**
     * Optional helper input used by the Node SDK to auto-generate one
     * `client_assertion` when the caller does not provide one explicitly.
     *
     * `clientId` and `audience` are resolved from the surrounding SMART request
     * input and therefore omitted here.
     */
    clientAssertionBuilder?: Omit<BuildClientAssertionJwtInput, 'clientId' | 'audience'>;
    redirectUri?: string;
    acrValues?: string;
    codeChallenge?: string;
    codeChallengeMethod?: 'S256';
    presentationSubmission?: Record<string, unknown>;
    purpose?: string;
    requestBodyClaims?: Record<string, unknown>;
    /** Compatibility bridge until every installed gdc-sdk-core-ts carries this field. */
    vpTokenFallback?: 'id-token' | 'omit';
    smartTokenKind?: 'token-exchange' | 'openid-smart';
    tokenCacheKey?: string;
    endpointId?: string;
    timeoutSeconds?: number;
    intervalSeconds?: number;
};
export type SmartTokenExchangeResult = {
    status: 'fetched' | 'cached' | 'failed';
    accessToken?: string;
    tokenType?: string;
    scopes?: string[];
    statusCode?: number;
    response?: unknown;
};
type CachedTokenWrite = {
    accessToken: string;
    tokenType: string;
    scopes: string[];
    expiresAt: number;
};
type RequestSmartTokenDeps = {
    input: SmartTokenRequestInput;
    routeCtx: RouteContext;
    baseUrl: string;
    defaultTimeoutMs?: number;
    defaultIntervalMs?: number;
    identityTokenExchangePath: (ctx: RouteContext) => string;
    identityTokenExchangePollPath: (ctx: RouteContext) => string;
    identityOpenIdSmartTokenPath: (ctx: RouteContext) => string;
    identityOpenIdSmartTokenPollPath: (ctx: RouteContext) => string;
    /**
     * Trusted runtime resolver for the provider that owns the subject.
     *
     * Product code may back this with an index/DID discovery adapter. The
     * high-level caller does not receive or manage the resolver's cache.
     */
    resolveSmartTokenEndpoint?: (subjectDid: string) => Promise<string | undefined>;
    submitAndPoll: (submitPath: string, pollPath: string, payload: {
        thid?: string;
    } & Record<string, unknown>, options?: PollOptions) => Promise<SubmitAndPollResult>;
    setTokenCache: (tokenCacheKey: string, token: CachedTokenWrite) => void;
};
/**
 * Executes the current GW token flow using injected transport dependencies.
 *
 * Implemented today:
 * - token-exchange flow
 * - OpenID4VP/SMART flow with `vp_token`
 * - normalized polling and token-cache writeback
 *
 * Still pending:
 * - endpoint resolution from provider DID metadata instead of route concatenation
 * - first-class runtime use of `DiscoveryFacade`/`IdentityStore`
 */
export declare function requestSmartTokenWithDeps(deps: RequestSmartTokenDeps): Promise<SmartTokenExchangeResult>;
export {};