import type { DpopKey } from './dpop.js';
import { type PoppyHttp } from './http.js';
import type { AgentIdentity } from './identity.js';
import type { AuthServerMetadata, DeviceAuthorizationResponse, TokenResponse } from './types.js';
export declare const GRANT_JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
export declare const GRANT_DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code";
export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
export interface TokenClientOptions {
    /**
     * `aud` of the client assertion. RFC 7523 allows the token endpoint URL (the default here,
     * matching the spec's examples) or the issuer identifier.
     */
    clientAssertionAudience?: 'token_endpoint' | 'issuer' | undefined;
}
export interface NarrowingParams {
    /** Ask for fewer scopes than the Session has (4.3 "Narrower tokens"). */
    scope?: string | undefined;
    /** RFC 8707 resource indicator. */
    resource?: string | undefined;
}
/**
 * OAuth calls against the Company's authorization server (section 4): every request carries
 * a `private_key_jwt` client assertion (4.1), and token requests carry a DPoP proof unless a
 * Bearer token (MCP) is wanted (4.3).
 */
export declare class TokenClient {
    private readonly identity;
    readonly metadata: AuthServerMetadata;
    private readonly http;
    private readonly opts;
    constructor(identity: AgentIdentity, metadata: AuthServerMetadata, http: PoppyHttp, opts?: TokenClientOptions);
    private clientAuth;
    /** POSTs a form; the builder runs per attempt so retries get fresh assertions. */
    private post;
    private toError;
    /** Any token-endpoint grant. Validates the response shape of 4.2/4.4. */
    token(params: () => Promise<Record<string, string | undefined>>, dpop?: DpopKey | undefined): Promise<TokenResponse>;
    /** JWT bearer grant: starts a Session, or renews a signed-out one with `sessionId` (4.2). */
    jwtBearer(input: {
        userId: string;
        sessionId?: string | undefined;
        dpop?: DpopKey | undefined;
    } & NarrowingParams): Promise<TokenResponse>;
    /** Account Token grant (4.8): signs a Session in, or starts a new signed-in Session. */
    refresh(input: {
        refreshToken: string;
        sessionId?: string | undefined;
        dpop?: DpopKey | undefined;
    } & NarrowingParams): Promise<TokenResponse>;
    /** Direct Sign-In code exchange (4.5 step 4). */
    authorizationCode(input: {
        code: string;
        redirectUri: string;
        codeVerifier: string;
        sessionId: string;
        dpop: DpopKey;
    }): Promise<TokenResponse>;
    /** Device Sign-In step 1 (4.6). */
    deviceAuthorization(scope: string): Promise<DeviceAuthorizationResponse>;
    /** Device Sign-In polling (4.6 step 3). Throws `authorization_pending` / `slow_down` etc. */
    deviceToken(input: {
        deviceCode: string;
        sessionId: string;
        dpop: DpopKey;
    }): Promise<TokenResponse>;
    /** RFC 7009 revocation of an Account Token (4.9). */
    revoke(token: string, hint?: 'refresh_token' | 'access_token'): Promise<void>;
}
//# sourceMappingURL=token_client.d.ts.map