import { type AuthMetricsInput } from '../../metrics.js';
import { Bearer, Receiver, Token } from '../../token.js';
import { custom, customJson, Logger } from '../../util/logging.js';
import type { AuthorizationOptions } from '../../authorization/provider.js';
/**
 * Shares renewable access tokens through a file cache and refreshes them in
 * the background.
 *
 * This class combines in-memory caching, a process-shared file cache, and one
 * renewal loop. Concurrent callers share an in-flight renewal. The wrapped
 * bearer must have a stable name because that name selects the cache entry.
 *
 * Call {@link AsyncRenewableBearer.close} at shutdown.
 */
export declare class AsyncRenewableBearer extends Bearer {
    [custom]: () => string;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.AsyncRenewableBearer";
    private readonly fileCache;
    private refreshTimer;
    private stopped;
    private inFlightRenewal;
    private waiters;
    private cacheToken;
    private fresh;
    private renewalRequested;
    private renewAttempt;
    private nextSyncOptions;
    private readonly lifetimeSafeFraction;
    private readonly safetyMinRemainingMs;
    private readonly initialRetryTimeoutMs;
    private readonly maxRetryTimeoutMs;
    private readonly retryTimeoutExponent;
    private readonly refreshRequestTimeoutMs;
    private readonly maxRetries;
    private readonly jitterFraction;
    private readonly logger;
    private readonly metrics;
    private source;
    /**
     * Extra lifetime required for the first cached token, in milliseconds.
     *
     * The constructor assigns the two-hour default when the option is `null` or
     * `undefined`. A valid cache hit keeps this margin for later fetches. The
     * value becomes `null` only when a fetch proceeds into the renewal path.
     */
    safetyMargin: number | null;
    /**
     * Creates a shared file-backed renewal layer.
     *
     * `cacheFilePath` selects the credentials file. `fileCacheThrottleMs` limits
     * disk checks. Renewal failures use jittered exponential backoff. `source`
     * must have a stable name for its cache entry.
     */
    constructor(source: Bearer, opts?: {
        /** Maximum total authentication attempts for one receiver. Defaults to 2. */
        maxRetries?: number;
        /**
         * Required remaining lifetime for an initially cached token, in milliseconds.
         *
         * Defaults to two hours. `null` also selects this default. Valid cache
         * hits keep the margin until a fetch enters the renewal path.
         */
        initialSafetyMarginMs?: number | null;
        /** Accepted for compatibility but not used by this implementation. */
        retrySafetyMarginMs?: number;
        /**
         * Fraction of remaining lifetime to wait before renewal.
         *
         * Defaults to `0.9`, which renews with about 10% left.
         */
        lifetimeSafeFraction?: number;
        /** Minimum lifetime kept before renewal, in milliseconds. Defaults to 15 seconds. */
        safetyMinRemainingMs?: number;
        /** Initial retry delay, in milliseconds. Defaults to one second. */
        initialRetryTimeoutMs?: number;
        /** Maximum retry delay, in milliseconds. Defaults to 60 seconds. */
        maxRetryTimeoutMs?: number;
        /** Multiplier for exponential retry delays. Defaults to `1.5`. */
        retryTimeoutExponent?: number;
        /**
         * Default budget passed to the source for a renewal, in milliseconds.
         *
         * Defaults to five seconds. It applies to foreground and background
         * renewal when the caller does not supply a synchronous override. The
         * source decides how it enforces the budget.
         */
        refreshRequestTimeoutMs?: number;
        /**
         * Random retry-delay variation from `0` to `1`.
         *
         * Defaults to `0.2`. Values outside the range are clamped.
         */
        jitterFraction?: number;
        /** Minimum interval between cache-file reads, in milliseconds. Defaults to five minutes. */
        fileCacheThrottleMs?: number;
        /** Shared YAML cache path. Defaults to `~/.nebius/credentials.yaml`. */
        cacheFilePath?: string;
        /** Optional destination for diagnostic events. */
        logger?: Logger;
        /** Optional authentication metrics destination. */
        metrics?: AuthMetricsInput;
        /** Metrics provider label. Defaults to the wrapped source provider. */
        provider?: string;
    });
    /** Returns a JSON-safe value for logs. */
    [customJson](): unknown;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /** Creates a token receiver. */
    receiver(): Receiver;
    /** Sets the metrics. */
    setMetrics(metrics: AuthMetricsInput): void;
    /** Schedules the next background renewal and replaces the current timer. */
    private scheduleNext;
    /** Computes the next renewal time from the token expiration time. */
    private computeNextTimeoutMs;
    private addWaiter;
    private drainWaitersWithToken;
    private drainWaitersWithError;
    private withJitter;
    private needRenew;
    private startRenewal;
    /**
     * Returns a valid token from memory, disk, or the renewal source.
     *
     * Synchronous renewal options wait and report failure. Otherwise a valid
     * cached token can be returned while one shared renewal continues.
     */
    fetch(timeoutMs?: number, options?: AuthorizationOptions | undefined): Promise<Token>;
    /** Returns whether the token must be renewed. */
    isRenewalRequired(): boolean;
    /** Schedules renewal without waiting; `invalidate` marks the cached value as rejected. */
    requestRenewal(invalidate?: boolean): void;
    /** Runs one renewal at a time, applies jittered backoff, and schedules the next renewal. */
    private run;
    /** Stops background renewal, rejects pending waiters, and closes the source. */
    close(graceMs?: number | undefined): Promise<void>;
}
//# sourceMappingURL=async_renewable_bearer.d.ts.map