import type { Auth0Environment } from "../../confluent/oauth/types.js";
/**
 * Owns the process's {@link AuthContext} and lazily drives PKCE on demand.
 * Construction is side-effect-free; callers go through {@link ensureLoggedIn}.
 *
 * State machine:
 *   - Idle: starts PKCE.
 *   - Logging in: concurrent callers share the in-flight Promise.
 *   - Logged in: no-op (or single-flight refresh if bearer tokens are stale).
 *   - Failed / refresh-family expired: clears ctx and starts a fresh PKCE.
 *   - Shut down: rejects.
 */
export declare class OAuthHolder {
    private readonly env;
    private ctx;
    private cleared;
    private readonly abortController;
    private inFlightLogin;
    constructor(env: Auth0Environment);
    getControlPlaneToken(): string | undefined;
    getDataPlaneToken(): string | undefined;
    /**
     * Ensure the holder has usable bearer tokens, starting PKCE on demand.
     * Single-flight, replayable after a PKCE failure, rejects after shutdown.
     */
    ensureLoggedIn(): Promise<void>;
    /**
     * Terminal — clears ctx (which stops the refresh loop) and aborts any
     * in-flight PKCE. Idempotent.
     */
    shutdown(): void;
    private runLogin;
}
//# sourceMappingURL=oauth-holder.d.ts.map