import type { FetchLike, GetKeyMaterial, OnEvent, CapturedSent } from './types.js';
import type { AAuthError } from './deferred.js';
export declare class TokenExchangeError extends Error {
    readonly status: number;
    readonly aauthError?: AAuthError | undefined;
    constructor(status: number, aauthError?: AAuthError | undefined);
}
export interface TokenExchangeOptions {
    signedFetch: FetchLike;
    authServerUrl: string;
    /** Cached auth-server metadata; when provided, skips the /.well-known fetch. */
    authServerMetadata?: AuthServerMetadata;
    /** Called with freshly-fetched metadata (only when authServerMetadata wasn't provided) so callers can persist it. */
    onMetadata?: (metadata: AuthServerMetadata) => void;
    resourceToken: string;
    justification?: string;
    localhostCallback?: string;
    loginHint?: string;
    tenant?: string;
    domainHint?: string;
    capabilities?: string[];
    prompt?: string;
    onInteraction?: (url: string, code: string) => void;
    onClarification?: (question: string) => Promise<string>;
    onEvent?: OnEvent;
    /** Total consent-poll timeout in seconds (default 900) — see pollDeferred. */
    maxPollDuration?: number;
    /**
     * Optional: when provided, agent_token is decoded and included in
     * ps_token_request:start and ps_metadata_request:start events for full
     * outgoing-token visibility under --log.
     */
    getKeyMaterial?: GetKeyMaterial;
    /**
     * Optional: mutable holder that signed-fetch's onSigned callback updates
     * after each signed request. exchangeToken reads `.latest` after its own
     * signedFetch calls to attach request_headers to :done events.
     */
    sentTracker?: {
        latest?: CapturedSent;
    };
}
export interface TokenExchangeResult {
    authToken: string;
    expiresIn: number;
}
export interface AuthServerMetadata {
    token_endpoint: string;
    jwks_uri?: string;
}
/**
 * Exchange a resource token for an auth token via the auth server.
 *
 * 1. Fetches auth server metadata (/.well-known/aauth-person.json)
 * 2. POSTs to token_endpoint with resource_token + hints, Prefer: wait=45
 * 3. If 200: returns tokens directly
 * 4. If 202: polls via pollDeferred until terminal response
 */
export declare function exchangeToken(options: TokenExchangeOptions): Promise<TokenExchangeResult>;
//# sourceMappingURL=token-exchange.d.ts.map