import type { TargetCredentialStore } from './credential-store.js';
import type { TargetRecord, SettingsPort } from './target-registry.js';
import { type Clock, type HttpTransport } from './device-flow.js';
import type { TargetSessionEndpoints } from './discovery.js';
export { LoginRequiredError } from './session-errors.js';
export interface BrowserOpener {
    open(url: string): Promise<void>;
}
export interface TargetSessionDeps {
    readonly http: HttpTransport;
    readonly clock: Clock;
    readonly browserOpener: BrowserOpener;
    readonly stderr: {
        write(s: string): void;
    };
    readonly discoveryEndpoints: TargetSessionEndpoints;
}
export interface TargetSessionManagerInit {
    readonly targetName: string;
    readonly target: TargetRecord;
    readonly credentialStore: TargetCredentialStore;
    readonly acquireLock: () => Promise<() => Promise<void>>;
    readonly settings: SettingsPort;
    readonly deps: TargetSessionDeps;
}
/**
 * Sole owner of one target's rotating refresh family and audience-scoped access cache.
 * The cross-process lock covers durable reread, exchange, replacement, and invalidation.
 */
export declare class TargetSessionManager {
    #private;
    constructor(init: TargetSessionManagerInit);
    login(signal?: AbortSignal): Promise<{
        organization: {
            id: string;
        };
    }>;
    getAccessTokenWithLifetime(audience: string, signal?: AbortSignal): Promise<{
        accessToken: string;
        expiresIn: number;
    }>;
    getAccessToken(audience: string, signal?: AbortSignal): Promise<string>;
    tokenProvider(audience: string): {
        getAccessToken(signal?: AbortSignal): Promise<string>;
    };
    revoke(force: boolean): Promise<void>;
    clearMemory(): void;
}