import type { DataModels } from '@5minds/processcube_engine_sdk';
export interface ServerAccessTokenOptions {
    /**
     * OAuth2 Client ID. Defaults to `process.env.PROCESSCUBE_SERVER_CLIENT_ID`.
     */
    clientId?: string;
    /**
     * OAuth2 Client Secret. Defaults to `process.env.PROCESSCUBE_SERVER_CLIENT_SECRET`.
     */
    clientSecret?: string;
    /**
     * Space-separated OAuth2 scopes. Defaults to `process.env.PROCESSCUBE_SERVER_SCOPES`
     * or `'upe_admin engine_read engine_write'`.
     */
    scopes?: string;
    /**
     * Authority URL. Defaults to `process.env.PROCESSCUBE_AUTHORITY_URL`.
     */
    authorityUrl?: string;
    /**
     * Skip the token cache and always fetch a fresh token.
     */
    skipCache?: boolean;
}
/**
 * Fetches a server-to-server access token using the OAuth2 Client Credentials flow.
 *
 * Tokens are cached and reused until they expire (with a safety buffer).
 * Throws on authentication errors (e.g. invalid credentials, blocked client).
 *
 * @param options Optional overrides for authority URL, credentials, and scopes.
 * @returns The access token string.
 */
export declare function getServerAccessToken(options?: ServerAccessTokenOptions): Promise<string>;
/**
 * Returns a server-to-server {@link DataModels.Iam.Identity} using the Client Credentials flow.
 *
 * Useful in External Tasks or other server-side code that needs to act as a service account
 * rather than an end user.
 *
 * @param options Optional overrides for authority URL, credentials, and scopes.
 * @returns An Identity with `token` and `userId`.
 */
export declare function getServerIdentity(options?: ServerAccessTokenOptions): Promise<DataModels.Iam.Identity>;