import type { A2AApprovedAction, A2ACorrelationMetadata, A2ASourceContextReference, A2AReadOnlyActionResult, AgentCard, Message, Task } from "./types.js";
export declare class A2ATaskTimeoutError extends Error {
    readonly taskId: string;
    readonly lastTask: Task;
    readonly lastState: string;
    readonly timeoutMs: number;
    constructor(taskId: string, lastTask: Task, timeoutMs: number);
}
/**
 * Sign a JWT for A2A cross-app identity verification.
 *
 * Uses an org-level secret by default for direct org-secret workflows. Callers
 * that are doing ordinary hosted cross-app delegation can set
 * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on
 * every app database having an identical org row. The token contains the
 * caller's email as `sub`, so the receiving app can verify who's calling.
 */
export declare function signA2AToken(email: string, orgDomain?: string, orgSecret?: string, options?: {
    expiresIn?: string | number;
    preferGlobalSecret?: boolean;
    audience?: string | string[];
    /**
     * Extra JWT claims to merge alongside `sub` / `org_domain`. Used by the
     * MCP connect flow to add a revocable `jti` and a `scope: "mcp-connect"`
     * marker. Reserved claims (`sub`, `org_domain`) cannot be overridden —
     * they are spread last so a caller can never spoof identity via this map.
     */
    extraClaims?: Record<string, unknown>;
}): Promise<string>;
export declare function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean;
export declare class A2AClient {
    private baseUrl;
    private apiKey?;
    private apiKeyAttempts;
    private endpointCandidates;
    private endpointResolved;
    private requestTimeoutMs?;
    constructor(baseUrl: string, apiKey?: string, options?: {
        requestTimeoutMs?: number;
        fallbackApiKeys?: string[];
    });
    /**
     * Detect which A2A path the target agent uses.
     * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.
     */
    resolveEndpoint(): Promise<void>;
    private headers;
    private markApiKeySucceeded;
    private rpc;
    getAgentCard(options?: {
        timeoutMs?: number;
    }): Promise<AgentCard>;
    send(message: Message, opts?: {
        contextId?: string;
        metadata?: Record<string, unknown>;
        idempotencyKey?: string;
        approvedActions?: A2AApprovedAction[];
        /**
         * If true, ask the server to return the task immediately in `working`
         * state and process the handler in the background. The caller should
         * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.
         *
         * Use this when you expect the handler may exceed a synchronous
         * serverless request budget.
         */
        async?: boolean;
    }): Promise<Task>;
    /**
     * Poll for a task by id. Used in async mode after `send({ async: true })`.
     */
    getTask(taskId: string, opts?: {
        requestTimeoutMs?: number;
    }): Promise<Task>;
    /**
     * Execute one receiver-approved read-only action without starting the
     * receiver's agent loop. The receiver still owns validation, credentials,
     * request scoping, and the explicit action exposure decision.
     */
    invokeAction(action: string, input?: Record<string, unknown>, opts?: {
        metadata?: A2ACorrelationMetadata;
    }): Promise<A2AReadOnlyActionResult>;
    /**
     * Send a message in async mode and poll until the task reaches a terminal
     * state. This is the recommended path on serverless hosts with short
     * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A
     * call can exceed the gateway limit.
     *
     * Each individual fetch returns quickly; long-running work happens on the
     * receiving side and is checked via `tasks/get`.
     */
    sendAndWait(message: Message, opts?: {
        contextId?: string;
        metadata?: Record<string, unknown>;
        idempotencyKey?: string;
        approvedActions?: A2AApprovedAction[];
        /** Total time to wait for completion. Default 5 min. */
        timeoutMs?: number;
        /** Poll interval. Default 2s. */
        pollIntervalMs?: number;
        /** Called with each polled task — useful for surfacing progress. */
        onUpdate?: (task: Task) => void;
    }): Promise<Task>;
    /**
     * Continue waiting for an existing async task without submitting a second
     * message. Use this after a bounded caller-side wait expires but the remote
     * task is still working.
     */
    waitForTask(taskId: string, opts?: {
        /** Total time to wait for completion. Default 5 min. */
        timeoutMs?: number;
        /** Poll interval. Default 2s. */
        pollIntervalMs?: number;
        /** Called with each successfully polled task. */
        onUpdate?: (task: Task) => void;
    }): Promise<Task>;
    private pollTask;
    stream(message: Message, opts?: {
        contextId?: string;
        metadata?: Record<string, unknown>;
    }): AsyncGenerator<Task>;
    private ensureEndpointCandidates;
    private postJson;
}
/**
 * One-shot convenience function: send a text message and get a text response.
 *
 * When A2A_SECRET is set and userEmail is provided, outbound calls are signed
 * with a JWT so the receiving app can cryptographically verify the caller's
 * identity (instead of blindly trusting metadata).
 */
export declare function callAgent(url: string, text: string, opts?: {
    apiKey?: string;
    /** Additional bearer tokens to try in order after apiKey during rotation. */
    apiKeyFallbacks?: string[];
    /** Additional transport metadata. Receivers must not use it as identity. */
    metadata?: Record<string, unknown>;
    contextId?: string;
    userEmail?: string;
    orgDomain?: string;
    orgSecret?: string;
    /** Origin used to build links back to the receiving app. */
    requestOrigin?: string;
    /** Exact downstream actions explicitly authorized in the caller's chat. */
    approvedActions?: A2AApprovedAction[];
    /** Opaque provenance reference resolved by the receiver through Dispatch. */
    sourceContext?: A2ASourceContextReference;
    /** Bounded telemetry-only lineage forwarded to the receiving app. */
    correlation?: A2ACorrelationMetadata;
    /** Stable caller-generated key for one message submission. */
    idempotencyKey?: string;
    /**
     * Use async/poll instead of a single blocking POST. Recommended for
     * cross-app calls that may exceed a synchronous serverless request budget.
     * Defaults to true so callers get safe behavior out of the box.
     */
    async?: boolean;
    /** Total time to wait for the polled task (default 5 min). */
    timeoutMs?: number;
    /**
     * Existing async task to keep polling. When set, no new message is sent.
     * This prevents a caller-side timeout from duplicating downstream work.
     */
    taskId?: string;
    /** Poll interval for async calls. Primarily useful for tests/retries. */
    pollIntervalMs?: number;
    /**
     * Return receiver-verified artifact text from the last polled task when
     * the call times out. Defaults to true for backwards compatibility.
     * Callers that can continue polling the remote task separately should set
     * this to false so the A2ATaskTimeoutError (and its taskId) is preserved.
     */
    returnRecoverableArtifactsOnTimeout?: boolean;
    /**
     * Called with each successfully polled task while an async call is still
     * in flight (see `A2AClient.sendAndWait`). Fires once per real poll
     * round-trip that returns a task — including the terminal poll — so
     * callers can surface genuine remote liveness/progress. Not called when a
     * poll fetch throws (remote unresponsive) or when the task completes
     * synchronously on submit. Only threaded through for async calls.
     */
    onUpdate?: (task: Task) => void;
}): Promise<string>;
/**
 * Invoke one receiver-approved read-only action with an audience-bound user
 * token. Unlike conversational delegation, this never starts the receiver's
 * model loop.
 */
export declare function callAction(url: string, action: string, input?: Record<string, unknown>, opts?: {
    apiKey?: string;
    userEmail?: string;
    orgDomain?: string;
    orgSecret?: string;
    requestTimeoutMs?: number;
    correlation?: A2ACorrelationMetadata;
}): Promise<A2AReadOnlyActionResult>;
//# sourceMappingURL=client.d.ts.map