import { type AuthMetricsInput } from '../metrics.js';
import { type FederatedCredentialsReader, FederatedCredentialsTokenRequester } from '../service_account/federated_credentials.js';
import { Bearer, Receiver } from '../token.js';
import { custom, customJson, Logger } from '../util/logging.js';
import type { SDKInterface } from '../../sdk.js';
/**
 * Exchanges an external identity credential for renewable Nebius access
 * tokens.
 *
 * A string input is a credential file path, not a credential value. The file
 * is read again for each exchange. When you supply a reader, also supply the
 * target `serviceAccountId`.
 *
 * @example Use a rotating workload credential file
 * ```ts
 * import { SDK } from '@nebius/js-sdk';
 * import { FederatedCredentialsBearer } from '@nebius/js-sdk/runtime/token/federated_credentials';
 *
 * // A prebuilt bearer needs a separate SDK for its unauthenticated exchange RPC.
 * const exchangeSdk = new SDK({
 *   userAgentPrefix: 'example-application/1.0',
 * });
 * const credentials = new FederatedCredentialsBearer(
 *   '/var/run/secrets/nebius/credential',
 *   {
 *     sdk: exchangeSdk,
 *     serviceAccountId: 'serviceaccount-e00example',
 *   },
 * );
 * const sdk = new SDK({
 *   credentials,
 *   userAgentPrefix: 'example-application/1.0',
 * });
 *
 * try {
 *   // Use sdk clients here.
 * } finally {
 *   await sdk.close();
 *   await exchangeSdk.close();
 * }
 * ```
 *
 * Close the SDK during shutdown to stop background renewal.
 */
export declare class FederatedCredentialsBearer extends Bearer {
    [custom]: () => string;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.FederatedCredentialsBearer";
    private _exchangeable;
    private _renewable;
    private _source;
    private readonly metrics;
    /**
     * Creates a renewable federated-credentials flow.
     *
     * Pass a {@link FederatedCredentialsTokenRequester} when you already
     * assembled the exchange request source. Pass a
     * {@link FederatedCredentialsReader} with `serviceAccountId` to let this
     * class assemble it.
     */
    constructor(federatedCredentials: FederatedCredentialsTokenRequester | FederatedCredentialsReader | string, opts?: {
        /**
         * SDK used for the token-exchange RPC.
         *
         * A prebuilt bearer must receive this SDK explicitly.
         */
        sdk?: SDKInterface | Promise<SDKInterface> | null;
        /** Maximum total authentication attempts for one receiver. Defaults to 2. */
        maxRetries?: number;
        /** Fraction of token lifetime to wait before proactive renewal. */
        lifetimeSafeFraction?: number;
        /** Initial renewal backoff, in milliseconds. */
        initialRetryTimeoutMs?: number;
        /** Maximum renewal backoff, in milliseconds. */
        maxRetryTimeoutMs?: number;
        /** Multiplier for exponential renewal backoff. */
        retryTimeoutExponent?: number;
        /**
         * Default token-exchange request budget, in milliseconds.
         *
         * It applies to foreground and background renewal when the caller does
         * not supply a synchronous override.
         */
        refreshRequestTimeoutMs?: number;
        /** Target service-account ID. Required when the input is a credential reader. */
        serviceAccountId?: string | null;
        /** Optional authentication metrics destination. */
        metrics?: AuthMetricsInput;
        /** Optional destination for diagnostic events. */
        logger?: Logger;
    });
    /** Returns a JSON-safe value for logs. */
    [customJson](): unknown;
    /** Sets or clears the SDK used for token exchange. */
    setSDK(sdk: SDKInterface | Promise<SDKInterface> | null): void;
    /** Sets the metrics. */
    setMetrics(metrics: AuthMetricsInput): void;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /** Creates a token receiver. */
    receiver(): Receiver;
}
//# sourceMappingURL=federated_credentials.d.ts.map