import { type Discovered, HttpJsonCache } from './discovery.js';
import { DpopKey } from './dpop.js';
import { PoppyHttp, type PoppyRequestInit } from './http.js';
import type { AgentIdentity } from './identity.js';
import type { AccountTokenRecord, CompanyState, StateStore, TokenRecord } from './store.js';
import { type NarrowingParams, TokenClient, type TokenClientOptions } from './token_client.js';
import type { AuthServerMetadata, PoppyDocument, TokenResponse } from './types.js';
import { type FetchLike, type SecurityOptions } from './util.js';
export interface PoppyAgentOptions extends SecurityOptions {
    store: StateStore;
    identity: AgentIdentity;
    /** Local user ("profile") the agent acts for. Defaults to `default`. */
    profile?: string | undefined;
    fetch?: FetchLike | undefined;
    log?: ((line: string) => void) | undefined;
    tokenClient?: TokenClientOptions | undefined;
    maxRetryAfterSeconds?: number | undefined;
}
/** Entry point: one agent identity, one local state file, one local user. */
export declare class PoppyAgent {
    readonly opts: PoppyAgentOptions;
    readonly http: PoppyHttp;
    readonly cache: HttpJsonCache;
    readonly profile: string;
    constructor(opts: PoppyAgentOptions);
    get identity(): AgentIdentity;
    get store(): StateStore;
    log(line: string): void;
    /** Discovers a Company and loads (or creates) this user's state there. */
    company(domain: string): Promise<CompanyClient>;
}
export interface SignInResult {
    grantedScope: string;
    /** Requested scopes the User didn't grant (4.4: "checks scope before continuing"). */
    missingScopes: string[];
    sessionId: string;
}
/** One User at one Company: Sessions, Account Token, and authenticated requests. */
export declare class CompanyClient {
    readonly agent: PoppyAgent;
    readonly discovered: Discovered;
    readonly state: CompanyState;
    readonly tokens: TokenClient;
    readonly dpop: DpopKey;
    constructor(agent: PoppyAgent, discovered: Discovered, state: CompanyState);
    get document(): PoppyDocument;
    get metadata(): AuthServerMetadata;
    get issuer(): string;
    get userId(): string;
    get http(): PoppyHttp;
    get security(): SecurityOptions;
    get accountToken(): AccountTokenRecord | undefined;
    save(): Promise<void>;
    /** Forget the current Session; the next request starts a new one. */
    newSession(): Promise<void>;
    /**
     * A valid Session Token. Starts a Session if there is none (signed in if an Account Token
     * exists, 4.8), renews it when it is close to expiry, and handles `invalid_session`,
     * `account_mismatch` and a revoked Account Token (`invalid_grant`) as 4.2/4.8/4.9 describe.
     */
    token(opts?: {
        bearer?: boolean | undefined;
        forceRenew?: boolean | undefined;
    } & NarrowingParams): Promise<TokenRecord>;
    private issue;
    private record;
    /** Stores the result of any sign-in type (4.4): Account Token + signed-in Session Token. */
    applySignIn(resp: TokenResponse, via: AccountTokenRecord['via'], requestedScope: string): Promise<SignInResult>;
    /** Sign out (4.9): revoke the Account Token. Sessions carry on signed out. */
    signOut(): Promise<boolean>;
    /** A Bearer Session Token for one MCP server (4.3 "Bearer tokens"). */
    bearerFor(resource: string, forceRenew?: boolean): Promise<string>;
    /**
     * An API or conversation request with `Authorization: DPoP` + a proof (4.3). Retries once
     * with a renewed token on `invalid_token`, and once with the Account Token on
     * `sign_in_required` when the current token is signed out but an Account Token exists.
     */
    fetch(url: string, init?: Omit<PoppyRequestInit, 'dpop' | 'accessToken' | 'scheme'> & NarrowingParams): Promise<Response>;
    /** `fetch` + JSON, mapping failures to typed errors (section 6, 7.13). */
    json<T>(url: string, init?: Omit<PoppyRequestInit, 'dpop' | 'accessToken' | 'scheme'> & NarrowingParams): Promise<{
        status: number;
        body: T;
    }>;
}
/** Maps a failed resource response to a typed error. */
export declare function throwForResponse(res: Response): Promise<never>;
//# sourceMappingURL=company.d.ts.map