import { OnModuleInit, OnModuleDestroy } from '@nestjs/common';
import { type ScopedClaimTokenRequest, type ScopedClaimTokenResponse } from '../types';
export declare const IDENTITY_BOOTSTRAP_CONFIG: unique symbol;
export declare enum IdentityBringUpState {
    NotStarted = "not_started",
    InProgress = "in_progress",
    Ready = "ready",
    Failed = "failed",
    Exhausted = "exhausted"
}
export interface IdentityBootstrapConfig {
    identityApiUrl?: string;
    identityApiInternalToken: string;
    serviceName: string;
    serviceDisplayName: string;
    serviceDescription?: string;
    keycloakUrl?: string;
    keycloakRealm?: string;
    clientId?: string;
    clientSecret?: string;
    tokenEndpoint?: string;
    agentWorkerClientId?: string;
    agentWorkerClientSecret?: string;
    maxRegistrationAttempts?: number;
    baseRetryDelay?: number;
    maxRetryDelay?: number;
}
export interface ScopedAccessToken {
    accessToken: string;
    expiresAtMs: number;
}
export declare class IdentityBootstrapService implements OnModuleInit, OnModuleDestroy {
    private readonly config;
    private readonly logger;
    private readonly client;
    private clientId;
    private clientSecret;
    private tokenEndpoint;
    private keycloakBaseUrl;
    private allowedRealms;
    private primaryRealm;
    private registrationTokenScope;
    private accessToken;
    private tokenExpiresAt;
    private tokenRefreshPromise;
    private readonly exactAudienceTokenCache;
    private readonly exactAudienceTokenInflight;
    private lastCredentialFetchAt;
    private static readonly RECOVERY_DEBOUNCE_MS;
    private static readonly DISTRIBUTED_RECOVERY_DEBOUNCE_MS;
    private readonly userTokenCache;
    private readonly userTokenInflight;
    private readonly scopedTokenCache;
    private readonly scopedTokenInflight;
    private registrationAttempts;
    private registrationTimer;
    private readonly maxRegistrationAttempts;
    private readonly baseRetryDelay;
    private readonly maxRetryDelay;
    private readyResolve;
    private readyPromise;
    private bringUpState;
    private bringUpInFlight;
    private get isReady();
    constructor(config: IdentityBootstrapConfig);
    private assertConfig;
    get serviceName(): string;
    onModuleInit(): Promise<void>;
    private bringUpIdentity;
    private performBringUp;
    onModuleDestroy(): void;
    getAccessToken(): Promise<string>;
    getAccessTokenForAudience(audience: string): Promise<string>;
    private mintExactAudienceToken;
    getUserAccessToken(params: {
        userId: string;
        actorSubject: string;
        orgId: string;
        realm?: string;
        audience?: string;
    }): Promise<string>;
    private mintUserAccessToken;
    mintScopedClaimToken(params: ScopedClaimTokenRequest): Promise<ScopedClaimTokenResponse>;
    getScopedAccessToken(params: {
        scopedClaims: Record<string, string>;
        realm?: string;
    }): Promise<ScopedAccessToken>;
    private mintScopedAccessToken;
    private buildRealmTokenEndpoint;
    private canonicalizeScopedClaims;
    waitForReady(timeoutMs?: number): Promise<boolean>;
    hasCredentials(): boolean;
    getClientId(): string | null;
    getKeycloakBaseUrl(): string | null;
    getAllowedRealms(): string[];
    isMember(orgId: string, userId: string, realm?: string): Promise<boolean>;
    listOrgIds(): Promise<string[]>;
    private startBackgroundRegistration;
    private attemptRegistration;
    private requireRegistrationMetadata;
    private resolveUserTokenRealm;
    private scheduleRetry;
    private clientSecretWasSelfRegistered;
    private refreshToken;
    private refreshTokenWithRecovery;
    private fetchCurrentCredentials;
    private requireIdentityApiUrl;
    private checkCredentialRecoveryState;
    private recordCredentialRecovery;
    private markReady;
    private markAttemptFailed;
    private markExhausted;
    private settleWaiters;
}