import { type AuthMetricsInput } from '../metrics.js';
import { Bearer, Receiver } from '../token.js';
import { custom, customJson, Logger } from '../util/logging.js';
/**
 * Provides cached, renewable credentials for an interactive federation
 * account.
 *
 * On the first login, the bearer opens a browser unless `noBrowserOpen` is
 * true. It writes the authorization URL with `writer`, waits for the local
 * callback, and stores the access token in the shared credentials file.
 * Later processes can reuse the cached token for the same profile.
 *
 * This flow is intended for people at a workstation. Use a service account or
 * workload federation for unattended applications.
 *
 * @example
 * ```ts
 * import { SDK } from '@nebius/js-sdk';
 * import { FederationAccountBearer } from '@nebius/js-sdk/runtime/token/federation_account';
 *
 * const credentials = new FederationAccountBearer(
 *   'developer',
 *   'client-id',
 *   'https://auth.example',
 *   'federation-id',
 * );
 * const sdk = new SDK({
 *   credentials,
 *   userAgentPrefix: 'example-application/1.0',
 * });
 * ```
 */
export declare class FederationAccountBearer extends Bearer {
    [custom]: () => string;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.FederationAccountBearer";
    private _source;
    private readonly metrics;
    /**
     * Creates an interactive federation flow for `profileName`.
     *
     * `timeoutMs` limits the wait for the browser callback. It does not limit the
     * following token HTTP request. `cacheFilePath` selects the shared token
     * cache. Close the SDK to stop renewal timers.
     */
    constructor(profileName: string, clientId: string, federationEndpoint: string, federationId: string, opts?: {
        /** Receives the authorization URL. The default writer uses `console.log`. */
        writer?: (s: string) => void;
        /** Optional destination for diagnostic events. */
        logger?: Logger;
        /** Prevents automatic browser launch when `true`. */
        noBrowserOpen?: boolean;
        /**
         * Timeout for the browser callback, in milliseconds.
         *
         * This value does not limit the following token HTTP request.
         */
        timeoutMs?: number;
        /** Maximum total authentication attempts for one receiver. Defaults to 2. */
        maxRetries?: number;
        /**
         * Extra lifetime required for the first cached token.
         *
         * Defaults to two hours. `null` also selects this default. Valid cache
         * hits keep the margin for later fetches. A fetch clears it only after it
         * proceeds into the renewal path.
         */
        initialSafetyMarginMs?: number | null;
        /** Reserved for compatibility. The JavaScript implementation does not use this value. */
        retrySafetyMarginMs?: number;
        /**
         * Fraction of remaining lifetime to wait before renewal.
         *
         * The default `0.9` renews with about 10% of the lifetime left.
         */
        lifetimeSafeFraction?: number;
        /** Initial renewal backoff. Defaults to one second. */
        initialRetryTimeoutMs?: number;
        /** Maximum renewal backoff. Defaults to 60 seconds. */
        maxRetryTimeoutMs?: number;
        /** Multiplier for exponential renewal backoff. Defaults to `1.5`. */
        retryTimeoutExponent?: number;
        /** Minimum interval between cache-file reads. Defaults to five minutes. */
        fileCacheThrottleMs?: number;
        /** Custom shared credentials-file path. */
        cacheFilePath?: string;
        /** Extra trusted CA certificates. This bearer currently forwards only a `Buffer` value. */
        ca?: Buffer | string | string[];
        /** Optional authentication metrics destination. */
        metrics?: AuthMetricsInput;
    });
    /** Returns a JSON-safe value for logs. */
    [customJson](): unknown;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /** Sets the metrics. */
    setMetrics(metrics: AuthMetricsInput): void;
    /** Creates a token receiver. */
    receiver(): Receiver;
}
//# sourceMappingURL=federation_account.d.ts.map