import { ExchangeTokenRequest } from '../../api/nebius/iam/v1/index.js';
import type { TokenRequester } from '../token/exchangeable.js';
import { custom, customJson, Logger } from '../util/logging.js';
/**
 * Supplies an external identity credential for service-account federation.
 *
 * The returned string is secret and can change between calls.
 */
export interface FederatedCredentialsReader {
    /** Returns the configured credentials. */
    credentials(): string;
}
/**
 * Builds a token-exchange request from an external credential and a target
 * service-account ID.
 *
 * The reader is called for every request, so file-backed credentials can
 * rotate without recreating this object.
 */
export declare class FederatedCredentialsTokenRequester implements TokenRequester {
    [custom]: () => string;
    /** ID of the service account that the external identity can act as. */ readonly serviceAccountId: string;
    /** Source of the current external credential. */ readonly credentials: FederatedCredentialsReader;
    private logger?;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.FederatedCredentialsTokenRequester";
    /** Creates a requester for the target service account and credential source. */
    constructor(
    /** ID of the service account that the external identity can act as. */ serviceAccountId: string, 
    /** Source of the current external credential. */ credentials: FederatedCredentialsReader, logger?: Logger | undefined);
    /** Returns a JSON-safe value for logs. */
    [customJson](): object;
    /** Returns the exchange token request. */
    getExchangeTokenRequest(): ExchangeTokenRequest;
}
/**
 * Keeps one external federation credential in memory.
 *
 * Use this for a short-lived process. Use {@link FileFederatedCredentials}
 * when another process can rotate the credential.
 */
export declare class StaticFederatedCredentials implements FederatedCredentialsReader {
    [custom]: () => string;
    private readonly _credentials;
    /** Stores the credential. Treat the input and return value as secrets. */
    constructor(_credentials: string);
    /** Returns a JSON-safe value for logs. */
    [customJson](): object;
    /** Returns the configured credentials. */
    credentials(): string;
}
/**
 * Reads an external federation credential from a text file on each call.
 *
 * Leading and trailing whitespace is removed. A leading `~` resolves to the
 * home directory. Protect the file from other users.
 *
 * @example
 * ```ts
 * import { FileFederatedCredentials } from '@nebius/js-sdk/runtime/service_account/federated_credentials';
 *
 * const source = new FileFederatedCredentials('~/.config/my-app/workload-token');
 * ```
 */
export declare class FileFederatedCredentials implements FederatedCredentialsReader {
    [custom]: () => string;
    /** Contains the credentials file path. */
    readonly filePath: string;
    /** Creates a new file federated credentials. */
    constructor(filePath: string);
    /** Returns a JSON-safe value for logs. */
    [customJson](): object;
    /** Reads and returns the current credential. Treat the result as a secret. */
    credentials(): string;
}
//# sourceMappingURL=federated_credentials.d.ts.map