import { type StoredKey } from './keys.js';
import type { ClientMetadata } from './types.js';
import { type SecurityOptions } from './util.js';
export interface IdentityConfig {
    /** Where the identity documents are served, e.g. `https://agent.example`. */
    baseUrl: string;
    clientName: string;
    /** Defaults to `{baseUrl}/logo.svg`, which `serve-identity` serves. */
    logoUri?: string | undefined;
    /** Signing keys; the first one signs. Public halves go in `jwks_uri`. */
    keys: StoredKey[];
    /** Extensions this agent supports (3.3). None by default. */
    extensions?: Record<string, {
        version: string;
    }> | undefined;
}
/** Lifetime of every assertion this agent signs. The browser assertion caps at 60s (section 5). */
export declare const ASSERTION_TTL_SECONDS = 60;
/**
 * The Personal Agent's identity (4.1): its `client_id` URL, its metadata document, and the
 * keys from `jwks_uri` that sign client assertions, Session assertions and browser assertions.
 */
export declare class AgentIdentity {
    readonly baseUrl: string;
    readonly clientName: string;
    readonly logoUri: string;
    readonly keys: StoredKey[];
    readonly extensions?: Record<string, {
        version: string;
    }> | undefined;
    constructor(cfg: IdentityConfig, sec?: SecurityOptions);
    /** `client_id` is the URL the metadata document is fetched from (4.1). */
    get clientId(): string;
    get jwksUri(): string;
    /** Same origin as `client_id`, as 4.1 requires for `redirect_uris`. */
    get redirectUri(): string;
    metadata(): ClientMetadata;
    /** The public key set. Never contains private members. */
    jwks(): {
        keys: Record<string, unknown>[];
    };
    private sign;
    /**
     * `private_key_jwt` client assertion (RFC 7523 section 2.2): `iss` = `sub` = `client_id`,
     * `aud` = the authorization server (its token endpoint by default), fresh `jti`.
     */
    clientAssertion(audience: string): Promise<string>;
    /**
     * The JWT bearer grant assertion that starts or renews a Session (4.2): names the agent in
     * `iss` and the User ID in `sub`; `aud` is the token endpoint as a single string.
     */
    sessionAssertion(userId: string, tokenEndpoint: string): Promise<string>;
    /** Browser assertion (section 5), header `typ: poppy-browser+jwt`, `exp` <= `iat` + 60. */
    browserAssertion(input: {
        userId: string;
        endpoint: string;
        sessionId: string;
        returnTo: string;
    }): Promise<string>;
}
//# sourceMappingURL=identity.d.ts.map