import type { IdentityTokenResponse } from '../core/device-code.js';
import { WorkspaceScopedResource } from './base.js';
export declare const EXTERNAL_USER_SESSION_CREATE_SCOPE = "external_user_sessions:create";
export interface ApiKeyTokenExchangeRequest {
    /** API key to exchange for an identity-issued JWT. */
    apiKey: string;
    /** Optional space-delimited OAuth scope restriction. */
    scope?: string;
}
export type ApiKeyTokenExchangeResponse = IdentityTokenResponse;
export interface ClientCredentialsTokenRequest {
    /** OAuth client ID for a workspace credential or external integration credential. */
    clientId: string;
    /** OAuth client secret. Plaintext secrets are shown only when credentials are created or rotated. */
    clientSecret: string;
    /** Optional space-delimited OAuth scope restriction. */
    scope?: string;
}
export type ClientCredentialsTokenResponse = IdentityTokenResponse;
export interface ExternalUserSessionTokenRequest {
    /**
     * Workspace to bind the external-user token to. Defaults to the client's
     * configured workspace ID.
     */
    workspaceId?: string;
    /**
     * Stable customer-side subject key for the external user. The platform
     * stores only a keyed hash of this value.
     */
    externalSubjectKey: string;
    /** Subject class for the external user. */
    subjectType: 'user' | 'anonymous';
    /** Service the external-user token may use. */
    serviceId: string;
    /** Optional materialized world entity UUID when the subject is already linked. */
    consumerEntityId?: string;
    /** Optional child-token TTL in seconds. Server accepts 900-3600 seconds. */
    ttlSeconds?: number;
    /** Optional space-delimited external-user scope restriction. */
    scope?: string;
    /**
     * Parent external-integration access token. When omitted, the SDK uses the
     * bearer token configured on this AmigoClient instance.
     */
    parentAccessToken?: string;
}
export interface ExternalUserSessionTokenResponse extends IdentityTokenResponse {
    session_id: string;
    consumer_subject_id: string;
    subject_type: 'user' | 'anonymous';
    consumer_entity_id?: string | null;
}
export interface RefreshTokenRequest {
    refreshToken: string;
    /** Workspace for workspace-scoped refresh flows. Defaults to omitted. */
    workspaceId?: string;
    /** Optional space-delimited OAuth scope restriction. */
    scope?: string;
}
export type RefreshTokenResponse = IdentityTokenResponse;
/**
 * Identity token operations exposed through the platform API base URL.
 *
 * The identity service's token endpoint is mounted at `POST /token` on the
 * same base URL used for the platform API.
 */
export declare class TokensResource extends WorkspaceScopedResource {
    /** Exchange an API key for an identity-issued JWT access token. */
    exchangeApiKey(request: ApiKeyTokenExchangeRequest): Promise<ApiKeyTokenExchangeResponse>;
    /**
     * Exchange OAuth client credentials for a parent JWT.
     *
     * External integration credentials must request only
     * `external_user_sessions:create`; that parent token is a delegation
     * credential for minting external-user sessions, not a general platform API
     * token.
     */
    exchangeClientCredentials(request: ClientCredentialsTokenRequest): Promise<ClientCredentialsTokenResponse>;
    /**
     * Mint a short-lived external-user session token from a parent
     * external-integration JWT.
     */
    createExternalUserSession(request: ExternalUserSessionTokenRequest): Promise<ExternalUserSessionTokenResponse>;
    /** Rotate a refresh token for a new access-token and refresh-token pair. */
    refresh(request: RefreshTokenRequest): Promise<RefreshTokenResponse>;
}
//# sourceMappingURL=tokens.d.ts.map