import { type CallOptions, type ChannelCredentials, Client, type ClientOptions, type Interceptor, Metadata } from '@grpc/grpc-js';
import { GetProfileRequest, type GetProfileResponse } from './api/nebius/iam/v1/index.js';
import { type KeepaliveOptions } from './runtime/keepalive.js';
import { type AuthMetricsLike, type MetricsLike } from './runtime/metrics.js';
import { type Resolver } from './runtime/resolver.js';
import { ServiceAccount as SA, type Reader as SAReader } from './runtime/service_account/service_account.js';
import { Handler as SDKHandler, Logger as SDKLogger } from './runtime/util/logging.js';
import type { Provider as AuthorizationProvider } from './runtime/authorization/provider.js';
import type { ConfigReaderLike } from './runtime/cli_config_interfaces.js';
import type { Request, RetryOptions } from './runtime/request.js';
import type { Token as AccessToken, Bearer as TokenBearer } from './runtime/token.js';
/**
 * Defines the SDK functions that generated service clients use.
 *
 * Implement this interface only when you need to provide a custom runtime to
 * generated clients. Most applications should create an {@link SDK} instead.
 * A generated client uses this interface to resolve its endpoint, reuse a gRPC
 * channel, add authorization, and write logs.
 */
export interface SDKInterface {
    /** Returns one shared gRPC client for the exact address string. */
    getClientByAddress(address: string): Client;
    /**
     * Resolves a protobuf service name to a gRPC address.
     *
     * `apiServiceName` is the API-specific endpoint name when it differs from
     * the protobuf service name.
     */
    getAddressFromServiceName(serviceName: string, apiServiceName?: string): string;
    /** Returns the parent ID that generated requests can insert when it is absent. */
    parentId(): string | undefined;
    /** Returns the provider that authenticates new requests, or `undefined`. */
    getAuthorizationProvider(): AuthorizationProvider | undefined;
    /** Logs SDK and request events. */
    logger: SDKLogger;
}
/**
 * Defines direct federation credentials.
 *
 * Use these options when you do not use a CLI {@link ConfigReaderLike}. The
 * first token request can open a browser and wait for the user to sign in.
 */
export type FederationCredentialsOptions = {
    /** Selects federation credentials. */
    type: 'federation';
    /** Identifies the local profile. */
    profileName: string;
    /** Identifies the OAuth client. */
    clientId: string;
    /** Sets the federation API endpoint. */
    federationEndpoint: string;
    /** Identifies the federation. */
    federationId: string;
    /** Receives browser authorization instructions. */
    writer?: (s: string) => void;
    /** Prevents the SDK from opening a browser. */
    noBrowserOpen?: boolean;
    /** Limits browser authorization in milliseconds. */
    timeoutMs?: number;
};
/**
 * Defines the service account values accepted by {@link SDKOptions.credentials}.
 *
 * Keep private keys outside source control. A reader can load the key only
 * when the SDK needs it.
 */
export type ServiceAccountInit = SA | SAReader | {
    serviceAccountId: string;
    publicKeyId: string;
    privateKeyPem: string;
};
/**
 * Defines the credential values that the SDK accepts.
 *
 * A string is treated as an access token. `{ tokenFile }` reads a token from a
 * file. Bearers and authorization providers can renew credentials. `null` and
 * `undefined` create an SDK without authorization.
 */
export type CredentialsInit = AuthorizationProvider | TokenBearer | SAReader | SA | ServiceAccountInit | AccessToken | {
    tokenFile: string;
} | string | FederationCredentialsOptions | null | undefined;
/**
 * Configures an {@link SDK} instance.
 *
 * {@link SDKOptions.credentials} has priority over
 * {@link SDKOptions.authorizationProvider}. Explicit {@link SDKOptions.domain}
 * and {@link SDKOptions.parentId} values have priority over values from
 * {@link SDKOptions.configReader}. Per-address connection values have priority
 * over global connection values.
 */
export interface SDKOptions {
    /** Resolves service names before the conventional resolver is used. */
    resolver?: Resolver;
    /** Replaces placeholders such as `{domain}` in resolved addresses. */
    substitutions?: Record<string, string>;
    /** Sets the default Nebius API domain. The default is the public Nebius domain. */
    domain?: string;
    /**
     * Reads credentials, an endpoint, and a parent ID from a configuration source.
     *
     * Use
     * {@link https://nebius.github.io/js-sdk/classes/runtime_cli_config.Config.html | Config}
     * from `runtime/cli_config` to read the Nebius CLI file.
     */
    configReader?: ConfigReaderLike;
    /**
     * Sets the default parent ID.
     *
     * Generated create and list requests can use this value when their
     * `parentId` field is empty.
     */
    parentId?: string;
    /** Sets an authorization provider when {@link SDKOptions.credentials} is not set. */
    authorizationProvider?: AuthorizationProvider;
    /**
     * Uses plaintext gRPC connections instead of TLS.
     *
     * Use this only for a trusted local test endpoint.
     */
    insecure?: boolean;
    /** Sets gRPC channel options for all addresses. */
    clientOptions?: Partial<ClientOptions>;
    /** Adds gRPC interceptors to all clients. */
    interceptors?: Interceptor[];
    /**
     * Sets credentials for authenticated requests.
     *
     * Prefer a bearer or provider for a long-running process because it can
     * renew tokens. Do not log a token string.
     */
    credentials?: CredentialsInit;
    /** Replaces the system TLS root certificates for gRPC and federation HTTP calls. */
    tlsRootCAs?: Buffer | string | string[];
    /** Receives federation authorization instructions from the configuration reader. */
    federationInvitationWriter?: (s: string) => void;
    /** Prevents browser launch during federation authorization. */
    federationInvitationNoBrowserOpen?: boolean;
    /** Limits federation authorization in milliseconds. */
    federationInvitationTimeoutMs?: number;
    /**
     * Adds the application name and version before the SDK user-agent.
     *
     * Use a stable value such as `example-application/1.0`.
     */
    userAgentPrefix?: string;
    /** Configures gRPC keepalive, or disables it when set to `false`. */
    keepalive?: KeepaliveOptions | false;
    /** Receives configuration and authorization metrics. Callback errors are ignored. */
    metrics?: MetricsLike;
    /** Receives authorization metrics when {@link SDKOptions.metrics} is not set. */
    authMetrics?: AuthMetricsLike;
    /** Sets a logger, log handler, or log level. */
    logger?: SDKLogger | SDKHandler | string | number;
    /**
     * Overrides connection settings for each exact resolved address.
     *
     * Overrides affect a client only when the SDK creates it. Configure them
     * before the first request to that address.
     */
    perAddress?: Record<string, {
        /** Replaces TLS or plaintext channel credentials for this address. */
        credentials?: ChannelCredentials;
        /** Selects plaintext (`true`) or TLS (`false`) for this address. */
        insecure?: boolean;
        /** Overrides global gRPC client options for this address. */
        clientOptions?: Partial<ClientOptions>;
        /** Runs after global interceptors for this address. */
        interceptors?: Interceptor[];
    }>;
}
/**
 * Creates service clients and owns shared SDK resources.
 *
 * Pass the SDK to a generated service client. A generated client creates a
 * {@link Request} when you call a service method. The SDK reuses one gRPC
 * channel for each resolved address and applies credentials to each request.
 *
 * Set {@link SDKOptions.userAgentPrefix} to your application name and version.
 * Create one SDK for the lifetime of an application, and call
 * {@link SDK.close} during shutdown.
 *
 * @example
 * ```ts
 * import { SDK } from '@nebius/js-sdk';
 * import { EnvBearer } from '@nebius/js-sdk/runtime/token/static';
 *
 * const sdk = new SDK({
 *   credentials: new EnvBearer('NEBIUS_IAM_TOKEN'),
 *   userAgentPrefix: 'example-application/1.0',
 * });
 * try {
 *   console.log(await sdk.whoami());
 * } finally {
 *   await sdk.close();
 * }
 * ```
 */
export declare class SDK implements SDKInterface {
    private _resolver;
    private _parentId;
    private _authorizationProvider?;
    private _creds;
    private _logger;
    private _clientOptions?;
    private _clients;
    private _extraInterceptors;
    private _perAddress;
    private _tlsRootCAs?;
    private _userAgent;
    private _keepaliveConfig;
    private _metrics;
    private _authMetrics;
    /**
     * Creates an SDK with the selected credentials and connection settings.
     *
     * Construction reads a supplied configuration reader and prepares TLS
     * settings. It does not send an API request. Some credential types defer
     * network access until the first authenticated request.
     *
     * @throws {Error} A supplied configuration reader can throw when its
     * configuration is invalid.
     */
    constructor(options?: SDKOptions);
    /** Returns the SDK logger. */
    get logger(): SDKLogger;
    private _initAuthorization;
    private _configureMetricsOnReader;
    private _isConfigMetricsAwareConfigReader;
    private _normalizeCredentials;
    private _mkSABearer;
    private _isAuthProvider;
    private _isBearer;
    private _isAccessToken;
    private _isTokenFile;
    private _isFederationInit;
    private _isSAReader;
    private _isSA;
    private _isSAParams;
    /**
     * Returns a shared gRPC client for an address.
     *
     * The first call creates the client. Later calls with the same address return
     * the same object. Changes from {@link addInterceptors} or
     * {@link setClientOptions} do not affect an existing client.
     */
    getClientByAddress(address: string): Client;
    /** Resolves a service name to a gRPC address. */
    getAddressFromServiceName(serviceName: string, apiServiceName?: string): string;
    /**
     * Returns the TLS root certificates for HTTP and gRPC calls.
     *
     * Credential helpers use this value so that their HTTP calls trust the same
     * roots as SDK gRPC calls. Do not modify a returned buffer.
     */
    getTlsRootCAs(): Buffer | string | string[] | undefined;
    /** Returns per-address channel credentials when set, or the SDK default. */
    getAddressCredentials(address: string): ChannelCredentials;
    /** Returns the current authorization provider. */
    getAuthorizationProvider(): AuthorizationProvider | undefined;
    /**
     * Returns the combined gRPC options for an address.
     *
     * The result contains keepalive settings and the SDK user-agent. Per-address
     * options override global options. Global interceptors run before
     * per-address interceptors.
     */
    getAddressOptions(address: string): Partial<ClientOptions>;
    /** Returns the default parent ID. */
    parentId(): string | undefined;
    /**
     * Replaces the authorization provider for new requests.
     *
     * The change does not restart a request that is already running. Pass
     * `undefined` to disable authorization for later requests.
     */
    setAuthorizationProvider(provider: AuthorizationProvider | undefined): void;
    /**
     * Uses a token bearer as the authorization provider for new requests.
     *
     * The SDK also connects the bearer to the configured authorization metrics.
     */
    setTokenBearerAsAuthorization(bearer: import('./runtime/token.js').Bearer): void;
    /**
     * Adds interceptors to clients that the SDK creates later.
     *
     * This method does not modify clients that are already in the shared client
     * cache.
     */
    addInterceptors(...ints: Interceptor[]): void;
    /**
     * Replaces the default gRPC client options for clients created later.
     *
     * This method does not modify clients that already exist.
     */
    setClientOptions(opts: Partial<ClientOptions> | undefined): void;
    /**
     * Returns the Nebius IAM profile for the current credentials.
     *
     * Await {@link Request.result}, or await the request directly. Use this call
     * to verify credentials before starting other work.
     *
     * @example
     * ```ts
     * const request = sdk.whoami();
     * const profile = await request.result;
     * console.log(profile);
     * console.log('request ID', await request.requestId);
     * ```
     */
    whoami(metadata?: Metadata, options?: Partial<CallOptions> & RetryOptions): Request<GetProfileRequest, GetProfileResponse>;
    /**
     * Closes the authorization provider and all shared gRPC channels.
     *
     * The default grace period is 20 seconds. After that period, this method
     * returns even if a close watcher has not completed. Do not start new
     * requests after calling this method.
     *
     * @example
     * ```ts
     * try {
     *   await sdk.whoami();
     * } finally {
     *   await sdk.close();
     * }
     * ```
     */
    close(graceMs?: number): Promise<void>;
}
//# sourceMappingURL=sdk.d.ts.map