import type { StoredKey } from './keys.js';
export interface TokenRecord {
    accessToken: string;
    tokenType: string;
    /** Epoch ms. */
    expiresAt: number;
    scope: string;
    sessionId: string;
    signedIn: boolean;
    /** RFC 8707 resource this token was issued for, if any. */
    resource?: string | undefined;
}
export interface AccountTokenRecord {
    /** The Account Token (an OAuth refresh token). A secret: never logged or shown (4.8). */
    refreshToken: string;
    scope: string;
    obtainedAt: number;
    /** Epoch ms, from `refresh_token_expires_in` when the Company sets one. */
    expiresAt?: number | undefined;
    /** Which sign-in type produced it. */
    via: 'direct' | 'device' | 'mediated';
}
export interface ConversationRecord {
    endpoint: string;
    /** Last event handled (a cursor / Last-Event-ID). */
    cursor?: string | undefined;
    parentConversationId?: string | undefined;
    createdAt: number;
    closed?: boolean | undefined;
}
/** Everything the agent remembers about one User at one Company (keyed by issuer, 3.2). */
export interface CompanyState {
    issuer: string;
    domains: string[];
    /** Opaque, random, per-Company User ID (4.2). Never derived from personal information. */
    userId: string;
    /** DPoP key for this User at this Company (4.3). Never published. */
    dpopKey: StoredKey;
    accountToken?: AccountTokenRecord | undefined;
    /** Session Tokens by key: `dpop` (default) or `dpop|scope|resource` / `bearer|resource`. */
    tokens: Record<string, TokenRecord>;
    /** The current Session's ID. Not a credential (4.2). */
    sessionId?: string | undefined;
    conversations: Record<string, ConversationRecord>;
}
export interface IdentityState {
    baseUrl: string;
    clientName: string;
    logoUri?: string | undefined;
    keys: StoredKey[];
}
export interface StateFile {
    version: 1;
    identity?: IdentityState | undefined;
    /** Local users ("profiles") of this agent, each with their Companies. */
    profiles: Record<string, {
        companies: Record<string, CompanyState>;
    }>;
}
export declare function defaultStatePath(): string;
/**
 * The local state file. It holds private keys and Account Tokens, so it is written with mode
 * 0600 (directory 0700) and atomically (temp file + rename).
 */
export declare class StateStore {
    #private;
    readonly path: string;
    data: StateFile;
    private readonly persist?;
    private constructor();
    /**
     * A state kept by the caller instead of a file — a server keeping each user's Companies in its
     * own database. `persist` receives the whole state on every save (serialized, like the file).
     */
    static memory(data?: StateFile, persist?: (data: StateFile) => Promise<void>): StateStore;
    static open(path?: string): Promise<StateStore>;
    /** Directory next to the state file, used for the Direct Sign-In callback relay. */
    get dir(): string;
    profile(name: string): {
        companies: Record<string, CompanyState>;
    };
    /**
     * Writes the state atomically (tmp file + rename). Saves are serialized: a conversation stream
     * and the prompt can save at the same time, and two writes sharing one tmp file made the second
     * `rename` fail with ENOENT.
     */
    save(): Promise<void>;
}
//# sourceMappingURL=store.d.ts.map