import { custom, customJson } from './util/logging.js';
import type { AuthorizationOptions } from './authorization/provider.js';
/**
 * Contains an access token and its optional expiration time.
 *
 * Keep the {@link Token.token} value secret. {@link Token.toString} and the SDK
 * logging helpers mask signatures and long payloads in recognized formats. A
 * short `v0` payload can remain visible. The {@link Token.token} getter and
 * {@link Token.toJSON} always return the original value.
 *
 * @example Inspect token state without reading the credential value
 * ```ts
 * import { Token } from '@nebius/js-sdk/runtime/token';
 *
 * const token = new Token(process.env.NEBIUS_TOKEN ?? '');
 * if (token.isEmpty() || token.isExpired()) {
 *   throw new Error('A valid access token is required');
 * }
 * console.log({ expiresAt: token.expiration });
 * ```
 */
export declare class Token {
    [custom]: () => string;
    /** Contains the fully qualified runtime type name. */
    readonly $type: 'nebius.iam.AccessToken';
    private readonly _tok;
    private readonly _exp?;
    /**
     * Creates a token.
     *
     * An omitted expiration means that the SDK cannot determine when the token
     * expires. It does not make the token valid forever.
     */
    constructor(token: string, expiration?: Date);
    /** Returns a safer log value. A short `v0` payload can remain visible. */
    [customJson](): object;
    /** Returns a diagnostic string. A short `v0` payload can remain visible. */
    toString(): string;
    /** Returns an empty token. */
    static empty(): Token;
    /** Returns the original token value. Treat the result as a secret. */
    get token(): string;
    /** Returns the token expiration time. */
    get expiration(): Date | undefined;
    /** Returns whether the token value is empty. */
    isEmpty(): boolean;
    /**
     * Reports whether the known expiration time has passed.
     *
     * Returns `false` when the token has no expiration time.
     */
    isExpired(): boolean;
    /**
     * Converts the token to its cache representation.
     *
     * The returned object contains the unmasked token. Store it only in a
     * protected location.
     */
    toJSON(): {
        token: string;
        expires_at: number | null;
    };
    /** Restores a token from the representation returned by {@link Token.toJSON}. */
    static fromJSON(data: {
        token?: string;
        expires_at?: number | null;
    }): Token;
    /** Returns whether two tokens contain the same value. */
    equals(other: unknown): boolean;
}
/**
 * Gets access tokens from one configured credential source.
 *
 * Applications normally pass a {@link Bearer} to the
 * {@link https://nebius.github.io/js-sdk/classes/sdk.SDK.html | SDK} and do not
 * create a receiver directly. The SDK creates one receiver for an
 * authentication flow. Each successful {@link Receiver.fetch} call updates
 * {@link Receiver.latest}.
 */
export declare abstract class Receiver {
    /** Contains the fully qualified runtime type name. */
    abstract readonly $type: string;
    protected _latest: Token | undefined;
    protected abstract _fetch(timeoutMs?: number, options?: AuthorizationOptions | undefined): Promise<Token>;
    /** Returns the last successfully fetched token, or `undefined` before the first success. */
    get latest(): Token | undefined;
    /**
     * Fetches a token and stores it as {@link Receiver.latest}.
     *
     * `timeoutMs` is a budget for sources that support timeouts. The source can
     * reject when it cannot get a token within this budget.
     */
    fetch(timeoutMs?: number, options?: AuthorizationOptions | undefined): Promise<Token>;
    /**
     * Reports whether authentication can retry after an error.
     *
     * The authorization interceptor calls this method. Application code should
     * not implement its own retry loop around {@link Receiver.fetch} unless it
     * owns the flow.
     */
    abstract canRetry(err: unknown, options?: AuthorizationOptions | undefined): boolean;
}
/**
 * Describes a credential source and creates receivers for it.
 *
 * Use a concrete bearer such as
 * {@link https://nebius.github.io/js-sdk/classes/runtime_token_static.StaticBearer.html | StaticBearer},
 * {@link https://nebius.github.io/js-sdk/classes/runtime_token_file.FileBearer.html | FileBearer},
 * or
 * {@link https://nebius.github.io/js-sdk/classes/runtime_token_service_account.ServiceAccountBearer.html | ServiceAccountBearer}.
 * Pass that bearer as
 * {@link https://nebius.github.io/js-sdk/interfaces/sdk.SDKOptions.html#credentials | SDKOptions.credentials}.
 * A bearer can own timers or other resources, so close the SDK when the
 * application shuts down.
 */
export declare abstract class Bearer {
    /** Contains the fully qualified runtime type name. */
    abstract readonly $type: string;
    /** Creates a token receiver. */
    abstract receiver(): Receiver;
    /**
     * Returns the stable credential name used by file-backed token caches.
     *
     * Most bearers do not have a name. Wrappers can add one with
     * {@link NamedBearer}.
     */
    get name(): string | undefined;
    /** Returns the next bearer in a wrapper chain, when this bearer wraps another source. */
    get wrapped(): Bearer | undefined;
    /** Returns the provider name for authorization metrics. */
    get metricProvider(): string;
    /** Stops owned background work and closes the wrapped bearer. */
    close(graceMs?: number): Promise<void>;
}
/**
 * Adds a stable name to another bearer without changing how it gets tokens.
 *
 * Names identify entries in shared token caches. Do not put access tokens,
 * private keys, or other secrets in a name.
 */
export declare class NamedBearer extends Bearer {
    [custom]: () => string;
    private readonly _wrapped;
    private readonly _name;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.NamedBearer";
    /** Creates a named wrapper. Receivers still come from the wrapped bearer. */
    constructor(_wrapped: Bearer, _name: string);
    /** Returns a JSON-safe value for logs. */
    [customJson](): unknown;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /** Returns the credential name. */
    get name(): string | undefined;
    /** Creates a token receiver. */
    receiver(): Receiver;
}
//# sourceMappingURL=token.d.ts.map