import { TokenExchangeService as ExchangeSvc } from '../../api/nebius/iam/v1/index.js';
import { type AuthMetricsInput, type AuthMetricsRecorder } from '../metrics.js';
import { Bearer, Receiver, Token } from '../token.js';
import { custom, customJson, type Logger } from '../util/logging.js';
import type { SDKInterface } from '../../sdk.js';
import type { AuthorizationOptions } from '../authorization/provider.js';
declare class ImpersonatedReceiver extends Receiver {
    [custom]: () => string;
    private readonly serviceAccountId;
    private readonly source;
    private svcOrPromise;
    private readonly defaultMaxRetries;
    private readonly logger?;
    private readonly metrics;
    readonly $type = "nebius.sdk.ImpersonatedReceiver";
    private trial;
    constructor(serviceAccountId: string, source: Receiver, svcOrPromise: ExchangeSvc | Promise<ExchangeSvc>, defaultMaxRetries?: number, logger?: Logger | undefined, metrics?: AuthMetricsRecorder);
    [customJson](): unknown;
    private getSvc;
    protected _fetch(timeoutMs?: number, options?: AuthorizationOptions): Promise<Token>;
    private exchange;
    canRetry(_err: unknown, options?: AuthorizationOptions): boolean;
}
/**
 * Exchanges an actor credential for an access token that acts as a service
 * account.
 *
 * The source bearer supplies the actor token. The actor must have permission to
 * impersonate `serviceAccountId`. This low-level bearer does not cache the
 * impersonated token.
 */
export declare class ImpersonatedBearer extends Bearer {
    [custom]: () => string;
    private readonly serviceAccountId;
    private readonly maxRetries;
    private readonly logger?;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.ImpersonatedBearer";
    private svc;
    private source;
    private readonly metrics;
    /**
     * Creates an impersonation exchange.
     *
     * `sdk` can be a ready SDK, an SDK promise, or `null`. Calling
     * {@link ImpersonatedBearer.receiver} while no SDK is set throws.
     */
    constructor(serviceAccountId: string, source: Bearer, sdk: SDKInterface | Promise<SDKInterface> | null, maxRetries?: number, logger?: Logger | undefined, metrics?: AuthMetricsInput);
    /** Returns a JSON-safe value for logs. */
    [customJson](): unknown;
    /** Returns the credential name. */
    get name(): string | undefined;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /** Returns the provider name for authorization metrics. */
    get metricProvider(): string;
    /** Sets the SDK. */
    setSDK(sdk: SDKInterface | Promise<SDKInterface> | null): void;
    /** Sets the metrics. */
    setMetrics(metrics: AuthMetricsInput): void;
    /** Creates a token receiver. */
    receiver(): Receiver;
}
/**
 * Adds in-memory renewal to {@link ImpersonatedBearer}.
 *
 * Use this variant for normal SDK requests so repeated calls reuse the
 * impersonated access token until renewal is required.
 *
 * @example
 * ```ts
 * import { SDK } from '@nebius/js-sdk';
 * import { CachedImpersonatedBearer } from '@nebius/js-sdk/runtime/token/impersonated';
 * import { EnvBearer } from '@nebius/js-sdk/runtime/token/static';
 *
 * // This SDK makes the unauthenticated token-exchange RPC.
 * const exchangeSdk = new SDK({
 *   userAgentPrefix: 'example-application/1.0',
 * });
 * const credentials = new CachedImpersonatedBearer(
 *   'serviceaccount-e00example',
 *   new EnvBearer(),
 *   exchangeSdk,
 * );
 * const sdk = new SDK({
 *   credentials,
 *   userAgentPrefix: 'example-application/1.0',
 * });
 *
 * try {
 *   // Use sdk clients here.
 * } finally {
 *   await sdk.close();
 *   await exchangeSdk.close();
 * }
 * ```
 */
export declare class CachedImpersonatedBearer extends Bearer {
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.CachedImpersonatedBearer";
    private readonly impersonated;
    private readonly source;
    /** Creates a new cached impersonated bearer. */
    constructor(serviceAccountId: string, source: Bearer, sdk: SDKInterface | Promise<SDKInterface> | null, opts?: {
        /** Maximum total authentication attempts for one receiver. Defaults to 2. */
        maxRetries?: number;
        /** Optional authentication metrics destination. */
        metrics?: AuthMetricsInput;
        /** Optional destination for diagnostic events. */
        logger?: Logger;
    });
    /** Returns the credential name. */
    get name(): string | undefined;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /** Creates a token receiver. */
    receiver(): Receiver;
    /** Sets the metrics. */
    setMetrics(metrics: AuthMetricsInput): void;
}
/** @internal */
export declare const __private: {
    ImpersonatedReceiver: typeof ImpersonatedReceiver;
    tokenExchangeAccessTokenType: string;
    tokenExchangeGrantType: string;
    tokenExchangeSubjectIdentifierType: string;
};
export {};
//# sourceMappingURL=impersonated.d.ts.map