interface OidcExchangeOptions {
    /** Full package name including scope, e.g. `@gjsify/cli`. */
    packageName: string;
    /** Registry URL, e.g. `https://registry.npmjs.org`. */
    registry: string;
    /** Optional verbose logger — receives single-line strings. */
    log?: (msg: string) => void;
}
export interface OidcExchangeResult {
    /** Short-lived npm token (`Authorization: Bearer <token>`-compatible). */
    token: string;
    /** Audience used for the GitHub OIDC token request. */
    audience: string;
}
export declare class OidcUnavailableError extends Error {
    readonly reason: 'no-env' | 'fetch-id-token' | 'no-id-token';
    constructor(message: string, reason: 'no-env' | 'fetch-id-token' | 'no-id-token');
}
export declare class OidcExchangeError extends Error {
    readonly status: number;
    readonly body: string;
    readonly packageName: string;
    constructor(message: string, status: number, body: string, packageName: string);
}
/**
 * Probe whether OIDC publishing is available in the current process —
 * cheap env-var check, no network access. Used by `gjsify publish` to
 * decide between OIDC and token-based auth in auto-detect mode.
 */
export declare function hasGithubOidcEnv(): boolean;
/**
 * Request a GitHub Actions OIDC ID token for the given audience.
 * Throws `OidcUnavailableError` when the required env vars are missing
 * (caller can fall back to token auth) or when GitHub rejects the request.
 */
export declare function fetchGithubOidcToken(audience: string, log?: (msg: string) => void): Promise<string>;
/**
 * Exchange a GitHub OIDC JWT for a short-lived npm publish token at
 * `/-/npm/v1/oidc/token/exchange/package/<escaped-name>`. The npm
 * registry validates the JWT against the package's Trusted Publisher
 * config — if no Trusted Publisher is configured, or the JWT comes from
 * a repo/workflow that doesn't match, the exchange returns a 4xx with
 * a descriptive body which we propagate as `OidcExchangeError`.
 */
export declare function exchangeOidcForNpmToken(args: OidcExchangeOptions & {
    idToken: string;
}): Promise<string>;
/**
 * End-to-end: probe env → fetch id-token → exchange for npm token.
 * One-shot convenience for `gjsify publish` and the verification command.
 */
export declare function getNpmTrustedToken(opts: OidcExchangeOptions): Promise<OidcExchangeResult>;
export {};
