import { type OAuthTokenResponse } from './fetchOAuthAccessToken.js';
/**
 * Interface for providing authentication tokens.
 */
export interface ITokenProvider {
    /**
     * Gets the current access token.
     *
     * A failed fetch rejects with the token endpoint and cause; throttled calls return undefined.
     * @returns Promise resolving to the access token or undefined when no token is available.
     */
    getAccessToken(): Promise<string | undefined>;
    /** Most recent token failure when no token could be obtained. */
    readonly lastTokenFailure?: Error;
    /**
     * Refreshes the access token by clearing cached tokens and obtaining a new one.
     * @returns Promise resolving to the new access token or undefined if not available.
     */
    refresh(): Promise<string | undefined>;
}
/**
 * No-op token provider for when authentication is not required.
 */
export declare class NoOpTokenProvider implements ITokenProvider {
    getAccessToken(): Promise<string | undefined>;
    refresh(): Promise<string | undefined>;
}
/**
 * OAuth token provider using the client credentials flow.
 *
 * Owns the access token so it can be attached to every RPC individually instead of
 * being baked into the channel at connect time: the token is fetched lazily on first
 * use, cached, and refreshed once it enters the refresh margin ahead of expiry, so
 * token expiry never invalidates the channel. A failed refresh falls back to the
 * cached token while it is still actually valid — only the refresh margin has been
 * crossed, not the expiry — and further attempts are throttled so an unreachable
 * auth endpoint does not turn every RPC into a fetch attempt.
 */
export declare class OAuthTokenProvider implements ITokenProvider {
    private readonly _tokenEndpoint;
    private readonly _fetchToken;
    private _accessToken?;
    private _expiresAt;
    private _lastFailedFetch?;
    private _lastFetchError?;
    private _refreshPromise?;
    get lastTokenFailure(): Error | undefined;
    /**
     * Creates a new {@link OAuthTokenProvider}.
     * @param tokenEndpoint - The OAuth2 token endpoint to request tokens from.
     * @param clientId - The client identifier.
     * @param clientSecret - The client secret.
     * @param skipTlsValidation - Whether to skip TLS certificate chain validation.
     * @param _fetchToken - Test-only seam replacing the OAuth2 token request.
     */
    constructor(_tokenEndpoint: string, clientId: string, clientSecret: string, skipTlsValidation?: boolean, _fetchToken?: () => Promise<OAuthTokenResponse>);
    getAccessToken(): Promise<string | undefined>;
    refresh(): Promise<string | undefined>;
    private hasFreshToken;
    private isThrottled;
    private cachedTokenWhileValid;
    private fetchAndCacheAccessToken;
    private lifetimeSecondsFrom;
}
export type TokenProvider = ITokenProvider;
//# sourceMappingURL=TokenProvider.d.ts.map