import { AccessTokenResponse } from '../types';
import { TokenCache } from './TokenCache';
export declare const DEFAULT_AUTH_SERVER = "https://login.spinque.com/";
export declare const DEFAULT_AUDIENCE = "https://rest.spinque.com/";
/**
 * Abstract class with utitily functions for working with access tokens such as storage
 */
export declare abstract class Authenticator {
    private _tokenCache;
    _accessToken?: string;
    _expires?: number;
    /**
     * The authentication that is currently running, if any. Concurrent callers of
     * {@link accessToken} - and out-of-band flows such as the PKCE callback - share this
     * single promise instead of starting competing authentications. It is always cleared once
     * settled (see {@link track}), including on failure, so a failed attempt never permanently
     * blocks future authentication.
     */
    private _inFlight?;
    constructor(_tokenCache: TokenCache);
    /**
     * Promise that will resolve with an access token if available or undefined otherwise.
     * This will try to fetch a new access token if:
     *  - the specific {@link Authenticator} implements the fetchAccessToken method, and
     *  - no unexpired access token is stored in this {@link Authenticator} instance or {@link TokenCache}.
     */
    get accessToken(): Promise<string | undefined>;
    /**
     * Registers `authentication` as the in-flight authentication so that other callers of
     * {@link accessToken} wait for it instead of starting their own. The in-flight marker is
     * cleared as soon as the promise settles - whether it resolves or rejects - so a failure
     * never deadlocks subsequent authentication attempts. Rejections are propagated to callers.
     *
     * Used both for authentications started by the {@link accessToken} getter and for flows that
     * obtain a token out-of-band (e.g. the PKCE callback trading a code for a token).
     */
    protected track(authentication: Promise<string | undefined>): Promise<string | undefined>;
    /**
     * Puts an access token and the expiration time in storage for usage when calling Spinque Query API
     */
    setAccessToken(accessToken: string, expiresIn: number): void;
    /**
     * Discards the currently stored access token, both in memory and from the token cache, so that
     * the next read of {@link accessToken} fetches a fresh one. Used to recover from a token that
     * the server rejected (HTTP 401) even though it had not yet expired client-side. Any
     * authentication that is already in flight is left untouched - joining it still yields a fresh
     * token.
     */
    invalidate(): void;
    /**
     * Abstract method that must be implemented by extending classes for specific OAuth 2.0 grants/flows.
     */
    abstract fetchAccessToken(): Promise<AccessTokenResponse | undefined>;
}