/**
 * GCP Identity Token Module
 *
 * PURPOSE: Acquire Google Cloud identity tokens for Cloud Run authentication
 *
 * CONSTRAINTS (NON-NEGOTIABLE):
 * - NO JWTs
 * - NO OAuth flows
 * - NO API keys
 * - NO long-lived tokens
 * - NO token validation or decoding
 *
 * The CLI relies on:
 * - Application Default Credentials (ADC)
 * - Existing gcloud auth login
 * - Cloud Run IAM for enforcement
 *
 * This module only acquires tokens; verification is done by Cloud Run.
 */
export interface IdentityTokenResult {
    token: string;
    audience: string;
}
export interface IdentityTokenError {
    type: 'not_authenticated' | 'gcloud_not_found' | 'token_acquisition_failed';
    message: string;
    details?: string;
}
/**
 * Acquire a Google Cloud identity token for the specified audience.
 *
 * This function:
 * 1. Checks for a cached valid token
 * 2. If not cached, invokes gcloud to get a new token
 * 3. Caches the token for the process duration
 *
 * The CLI NEVER validates or decodes the token.
 * Cloud Run IAM handles all verification.
 *
 * @param audience - The Cloud Run service URL (e.g., https://service-xxx.run.app)
 * @returns The identity token
 * @throws AuthError if token acquisition fails
 */
export declare function acquireIdentityToken(audience: string): string;
/**
 * Check if the user has valid GCP credentials.
 * Returns true if gcloud auth is configured, false otherwise.
 * Does NOT acquire or cache tokens.
 */
export declare function hasValidCredentials(): boolean;
/**
 * Get the currently active GCP account (if any).
 * Returns null if not authenticated.
 */
export declare function getActiveAccount(): string | null;
/**
 * Clear the in-process token cache.
 * Useful for testing or forcing re-authentication.
 */
export declare function clearTokenCache(): void;
//# sourceMappingURL=gcp-identity.d.ts.map