import type { AuditScanResult, AuditScoreResult } from "../contract";
/**
 * Any failure to obtain a result from ora: network, HTTP, rate limit, timeout.
 *
 * `code` is the server's machine-readable reason where it gave one, so a
 * caller can branch without matching on prose, and `payload` is the error
 * object exactly as ora served it (what `--json` prints - invariant 4). Both
 * are null/undefined for the failures ora has no code for.
 */
export declare class AuditApiError extends Error {
    readonly code: string | null;
    readonly payload: unknown;
    constructor(message: string, options?: {
        code?: string | null;
        payload?: unknown;
    });
}
/**
 * ora's answer for a target whose MCP handshake needs credentials (contract
 * 1.25.0): the scan is refused rather than scored, so there is no score to
 * gate on. Not a failure - the CLI reports it and exits 0.
 */
export declare const MCP_AUTH_REQUIRED = "MCP_AUTH_REQUIRED";
/** True when ora refused the scan because the MCP server wants credentials. */
export declare function isMcpAuthRequired(error: unknown): error is AuditApiError;
/**
 * The raw audit payload: scan-shaped from the stream's terminal event,
 * score-shaped once deep-analysis polling has taken over.
 */
export type AuditResult = AuditScanResult | AuditScoreResult;
export interface AuditOutcome {
    /** The raw `?format=audit` contract payload, untouched. */
    result: AuditResult;
    /**
     * ora's one-line agentic verdict. Rides the stream's `summary_ready` event,
     * not the audit payload, so it is carried alongside rather than injected.
     */
    verdict?: string;
}
export interface AuditOptions {
    /** Receives one-line progress updates while the scan streams and polls. */
    progress?: (line: string) => void;
    /** Base URL override; otherwise $ORA_API_URL, otherwise https://ora.ai. */
    baseUrl?: string;
    /** Abort when the stream is silent for this long (default 60s). */
    idleMs?: number;
    pollEveryMs?: number;
    pollLimit?: number;
    /** Freshness window in seconds (server clamps to [3600, 86400]). */
    maxAgeSeconds?: number;
    /** Bypass the freshness cache (spends the stricter 6/day force budget). */
    force?: boolean;
    /** Store the result as disposable (tunnel hosts are auto-classified). */
    ephemeral?: boolean;
    /**
     * ora-issued scan API key (contract 1.10.0): exempts the caller from every
     * scan-family rate limit. Falls back to $ORA_SCAN_API_KEY. Safe to send
     * blind — the server degrades an unrecognized key to keyless, never a 401.
     */
    apiKey?: string;
}
/**
 * Audit `target` and resolve with ora's raw audit payload. When the stream
 * ends with analysis still marked partial, keeps polling
 * GET /api/score/{domain}?format=audit until it settles (complete or stuck)
 * or the poll budget runs out.
 */
export declare function performAudit(target: string, options?: AuditOptions): Promise<AuditOutcome>;