import { Context } from "hono";
import { KeysAdapter, TenantsDataAdapter } from "@authhero/adapter-interfaces";
import { Bindings, Variables } from "../types";
import { SigningKeyModeOption } from "../types/AuthHeroConfig";
declare const AUTH_SERVICE_CLIENT_ID = "auth-service";
export interface ServiceTokenResponse {
    access_token: string;
    token_type: "Bearer";
    expires_in: number;
}
export interface CreateServiceTokenCoreParams {
    tenants: TenantsDataAdapter;
    keys: KeysAdapter;
    tenantId: string;
    scope: string;
    issuer: string;
    expiresInSeconds?: number;
    customClaims?: Record<string, unknown>;
    /**
     * Optional per-tenant signing-key bucket selector. When unset the
     * tenant uses the shared control-plane keys (legacy behavior) which
     * keeps existing outbox/cron callers working without any change.
     */
    signingKeyMode?: SigningKeyModeOption;
}
/**
 * Ctx-free service token minter. Produces a signed JWT for the `auth-service`
 * client using the tenant's current JWT signing key. Intended to be shared
 * between the request-time outbox dispatcher and the cron `runOutboxRelay`
 * helper so both paths emit tokens with identical issuer, subject, tenant
 * binding, and signing key.
 */
export declare function createServiceTokenCore(params: CreateServiceTokenCoreParams): Promise<ServiceTokenResponse>;
export declare function createServiceToken(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenant_id: string, scope: string, expiresInSeconds?: number, customClaims?: Record<string, unknown>): Promise<{
    access_token: string;
    token_type: string;
    expires_in: number;
}>;
/**
 * Bound ctx-free token factory for outbox destinations. Mirrors the shape
 * expected by `WebhookDestination` and `createDefaultDestinations` but uses
 * `createServiceTokenCore` under the hood so the inline per-request outbox
 * dispatcher and the cron `runOutboxRelay` emit identical tokens.
 */
export declare function makeOutboxServiceTokenFactory(deps: {
    tenants: TenantsDataAdapter;
    keys: KeysAdapter;
    issuer: string;
    signingKeyMode?: SigningKeyModeOption;
}): (tenantId: string, scope?: string) => Promise<string>;
export interface CreateClientServiceTokenParams {
    clientId: string;
    scope: string;
    audience?: string;
    expiresInSeconds?: number;
    customClaims?: Record<string, unknown>;
}
export interface CreateClientServiceTokenOptions {
    /**
     * When the client isn't found in the request tenant, resolve it against the
     * configured control-plane tenant and mint there instead. Off by default so
     * that the hook-facing token API (`createTokenAPI`) cannot reach across the
     * tenant boundary into control-plane clients — only trusted internal callers
     * (e.g. the auth service's own email/SMS senders) opt in.
     */
    allowControlPlaneFallback?: boolean;
}
/**
 * In-process mint of a grant-bounded access token for a DB-registered M2M
 * client. The caller is trusted (running inside the Worker) so no client
 * secret is required — authorization is governed by the client's
 * `client_grant` records. Mirrors what the token endpoint would return for a
 * `client_credentials` grant.
 *
 * Fails closed: rejects if the client has no grant for the (audience), or if
 * any requested scope is not in `grant.scope`.
 */
export declare function createClientServiceToken(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, params: CreateClientServiceTokenParams, options?: CreateClientServiceTokenOptions): Promise<ServiceTokenResponse>;
export { AUTH_SERVICE_CLIENT_ID };
