import { type AuthMetricsInput } from '../metrics.js';
import { ServiceAccount, type Reader as ServiceAccountReader } from '../service_account/service_account.js';
import { Bearer, Receiver } from '../token.js';
import { custom, customJson, Logger } from '../util/logging.js';
import type { SDKInterface } from '../../sdk.js';
/**
 * Provides automatically renewed access tokens for a service account.
 *
 * This is the main service-account credential for the
 * {@link https://nebius.github.io/js-sdk/classes/sdk.SDK.html | SDK}. It signs
 * a short-lived assertion, exchanges it for an access token, keeps the access
 * token in memory, and renews it before expiration.
 *
 * @example Use separate service-account fields
 * ```ts
 * import { SDK } from '@nebius/js-sdk';
 *
 * // Raw service-account values let SDK create and connect the exchange flow.
 * const sdk = new SDK({
 *   credentials: {
 *     serviceAccountId: process.env.NEBIUS_SERVICE_ACCOUNT_ID ?? '',
 *     privateKeyPem: process.env.NEBIUS_PRIVATE_KEY_PEM ?? '',
 *     publicKeyId: process.env.NEBIUS_PUBLIC_KEY_ID ?? '',
 *   },
 *   userAgentPrefix: 'example-application/1.0',
 * });
 * ```
 *
 * Close the SDK during shutdown. This stops the renewal timer.
 */
export declare class ServiceAccountBearer extends Bearer {
    [custom]: () => string;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.ServiceAccountBearer";
    private _exchangeable;
    private _renewable;
    private _source;
    private readonly metrics;
    /**
     * Creates renewable service-account credentials.
     *
     * `serviceAccount` can be a reader, a complete {@link ServiceAccount}, or a
     * service account ID. When it is an ID, `privateKeyPem` and `publicKeyId`
     * are required. Do not supply these two options for the other input forms.
     */
    constructor(serviceAccount: ServiceAccountReader | ServiceAccount | string, opts?: {
        /**
         * SDK used for the token-exchange RPC.
         *
         * Required for a prebuilt bearer. As an easier alternative, pass raw
         * service-account values to `new SDK({ credentials: ... })`.
         */
        sdk?: SDKInterface | Promise<SDKInterface> | null;
        /** PEM private key. Required only when `serviceAccount` is an ID string. */
        privateKeyPem?: string;
        /** Registered public-key ID. Required only when `serviceAccount` is an ID string. */
        publicKeyId?: string;
        /** Maximum total authentication attempts for one receiver. Defaults to 2. */
        maxRetries?: number;
        /** Fraction of token lifetime to wait before proactive renewal. */
        lifetimeSafeFraction?: number;
        /** Initial renewal backoff, in milliseconds. */
        initialRetryTimeoutMs?: number;
        /** Maximum renewal backoff, in milliseconds. */
        maxRetryTimeoutMs?: number;
        /** Multiplier for exponential renewal backoff. */
        retryTimeoutExponent?: number;
        /**
         * Default token-exchange request budget, in milliseconds.
         *
         * It applies to foreground and background renewal when the caller does
         * not supply a synchronous override.
         */
        refreshRequestTimeoutMs?: number;
        /** Optional authentication metrics destination. */
        metrics?: AuthMetricsInput;
        /** Optional destination for diagnostic events. */
        logger?: Logger;
    });
    /** Returns a JSON-safe value for logs. */
    [customJson](): unknown;
    /** Sets or clears the SDK used for token exchange. */
    setSDK(sdk: SDKInterface | Promise<SDKInterface> | null): void;
    /** Sets the metrics. */
    setMetrics(metrics: AuthMetricsInput): void;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /**
     * Creates a receiver that shares this bearer’s renewal state.
     *
     * The bearer must have the exchange SDK supplied in its constructor options
     * before the first token exchange. An SDK does not connect a prebuilt bearer.
     */
    receiver(): Receiver;
}
//# sourceMappingURL=service_account.d.ts.map