/** Validate grant binding from the trusted issuer's TLS response. One verifies signatures at its API boundary. */
export declare function readIdentityTokenMetadata(token: string, binding: {
    issuer: string;
    clientId: string;
    resource: string;
}): {
    organizationId: string;
    subject: string;
};