import { type AuthMetricsInput } from '../metrics.js';
import { Bearer, Receiver, Token } from '../token.js';
import { custom, customJson, Logger } from '../util/logging.js';
import type { AuthorizationOptions } from '../authorization/provider.js';
/** Reports that a renewable bearer could not provide a valid access token. */
export declare class RenewalError extends Error {
    /** Creates a new renewal error. */
    constructor(message: string);
}
/**
 * Keeps an access token in memory and renews it through another bearer.
 *
 * Concurrent callers share one in-flight renewal. A successful fetch schedules
 * background renewal before expiration. A failed background renewal uses
 * jittered exponential backoff, while a still-valid cached token can continue
 * to serve requests.
 *
 * The timer does not keep Node.js running. Call {@link RenewableBearer.close}
 * during orderly shutdown to reject waiters and close the wrapped source.
 */
export declare class RenewableBearer extends Bearer {
    [custom]: () => string;
    /** Contains the fully qualified runtime type name. */
    readonly $type = "nebius.sdk.RenewableBearer";
    private refreshTimer;
    private stopped;
    private inFlightRenewal;
    private waiters;
    private cacheToken;
    private fresh;
    private renewalRequested;
    private renewAttempt;
    private nextSyncOptions;
    private readonly lifetimeSafeFraction;
    private readonly initialRetryTimeoutMs;
    private readonly maxRetryTimeoutMs;
    private readonly retryTimeoutExponent;
    private readonly refreshRequestTimeoutMs;
    private readonly maxRetries;
    private readonly jitterFraction;
    private readonly logger?;
    private readonly metrics;
    private source;
    /**
     * Creates an in-memory renewal layer around `source`.
     *
     * `lifetimeSafeFraction` selects the fraction of remaining lifetime to wait
     * before renewal. Retry delays use exponential backoff and bounded jitter.
     */
    constructor(source: Bearer, opts?: {
        /** Maximum total authentication attempts for one receiver. Defaults to 2. */
        maxRetries?: number;
        /**
         * Fraction of remaining token lifetime to wait before renewal.
         *
         * Defaults to `0.9`, which renews with about 10% left.
         */
        lifetimeSafeFraction?: number;
        /** Initial renewal retry delay, in milliseconds. Defaults to one second. */
        initialRetryTimeoutMs?: number;
        /** Maximum renewal retry delay, in milliseconds. Defaults to 60 seconds. */
        maxRetryTimeoutMs?: number;
        /** Multiplier for exponential retry delays. Defaults to `1.5`. */
        retryTimeoutExponent?: number;
        /**
         * Default budget for a renewal request, in milliseconds.
         *
         * Defaults to five seconds. It applies to foreground and background
         * renewal when the caller does not supply a synchronous override. The
         * source decides how it enforces the budget.
         */
        refreshRequestTimeoutMs?: number;
        /** Accepted for compatibility but not used by this implementation. */
        safetyMinRemainingMs?: number;
        /**
         * Random retry-delay variation from `0` to `1`.
         *
         * Defaults to `0.2`. Values outside the range are clamped.
         */
        jitterFraction?: number;
        /** Optional destination for diagnostic events. */
        logger?: Logger;
        /** Optional authentication metrics destination. */
        metrics?: AuthMetricsInput;
        /** Provider label for metrics. Defaults to the wrapped bearer name. */
        provider?: string;
    });
    /** Returns a JSON-safe value for logs. */
    [customJson](): unknown;
    /** Returns the wrapped bearer. */
    get wrapped(): Bearer | undefined;
    /** Creates a token receiver. */
    receiver(): Receiver;
    /** Sets the metrics. */
    setMetrics(metrics: AuthMetricsInput): void;
    /** Schedules the next background renewal and replaces the current timer. */
    private scheduleNext;
    /** Computes the next renewal time from the token expiration time. */
    private computeNextTimeoutMs;
    private addWaiter;
    private drainWaitersWithToken;
    private drainWaitersWithError;
    private withJitter;
    private needRenew;
    private startRenewal;
    /**
     * Returns a valid token and starts renewal when required.
     *
     * With {@link AuthorizationOptions.renewSynchronous} or
     * {@link AuthorizationOptions.reportError}, this method waits for renewal
     * and reports its error. Otherwise it can return a valid cached token while
     * renewal continues. If no cached token exists, it waits for the first one.
     */
    fetch(timeoutMs?: number, options?: AuthorizationOptions): Promise<Token>;
    /** Reports whether the cached token is absent, invalidated, expired, or due for renewal. */
    isRenewalRequired(): boolean;
    /**
     * Schedules renewal as soon as possible.
     *
     * Set `invalidate` after an authentication rejection. This method does not
     * wait for renewal.
     */
    requestRenewal(invalidate?: boolean): void;
    /** Runs one renewal at a time, applies jittered backoff, and schedules the next renewal. */
    private run;
    /** Stops renewal, rejects pending waiters, and closes the wrapped bearer. */
    close(graceMs?: number): Promise<void>;
}
//# sourceMappingURL=renewable.d.ts.map