/**
 * SMART Backend Services auth provider.
 *
 * Manages client-credentials token acquisition and proactive refresh
 * using a private RSA key and the JWT Bearer client-assertion flow (RFC 7523).
 */
export default class fhirStarter implements Provider {
    private readonly config;
    private readonly privateKeyText;
    private readonly refreshCallbacks;
    private cache;
    private refreshPromise;
    private refreshTimer;
    private privateKeyObj;
    private started;
    private refreshFailed;
    private refreshRetryMs;
    /**
     * @param config - Auth configuration including client ID, private key, token endpoint, and scopes.
     * @throws If any required field is missing, blank, or invalid.
     */
    constructor(config: AuthConfig);
    /** The current access token, or `null` if no valid token is cached. */
    get token(): string | null;
    /** Seconds until the cached token expires, or `null` if no valid token is cached. */
    get expiresIn(): number | null;
    /** Ready-to-use `Authorization` header value (e.g. `"Bearer <token>"`), or `null` if no valid token is cached. */
    get authorizationHeader(): string | null;
    /**
     * Acquires an initial token and starts the proactive background refresh timer.
     * Safe to call multiple times — subsequent calls are no-ops.
     * @throws If the initial token acquisition fails.
     */
    start: () => Promise<void>;
    /**
     * Stops the background refresh timer.
     * Any in-flight refresh will still complete, but no new timers will be scheduled.
     */
    stop: () => void;
    /**
     * Returns a live `LiveTokenResponse` object whose `access_token` and `expires_in`
     * properties are always read from the current cache.
     * Useful for libraries that hold a reference to a token response object.
     */
    tokenResponse: () => LiveTokenResponse;
    /**
     * Registers a callback that is invoked whenever a new access token is obtained.
     * The callback is called immediately with the current token if one is already cached.
     * @param callback - Receives the new access token string.
     * @returns An unsubscribe function call it to stop receiving updates.
     */
    onRefresh: (callback: RefreshCallback) => (() => void);
    /**
     * Returns the public JWKS derived from the configured private key.
     * Private key material (`d`, `p`, `q`, etc.) is stripped before returning.
     */
    getJwks: () => Promise<JwkSet>;
    /**
     * Returns a valid access token, refreshing if the cached token is at or past its refresh threshold.
     * Falls back to a not-yet-expired stale token if the refresh request fails.
     * @throws If no cached token is available and the refresh request fails.
     */
    getAccessToken: () => Promise<string>;
    private doRefresh;
    private scheduleRefresh;
    private notifyRefresh;
    private refreshAccessToken;
    private getPrivateKey;
    private buildJwt;
    private static normalizeScopes;
    private static resolvePrivateKey;
    /**
     * Derives a deterministic key identifier from a private key using an
     * RFC 7638 JWK Thumbprint (SHA-256 of canonical RSA public JWK members, base64url).
     *
     * @param privateKey - RSA PKCS#8 PEM text, a Buffer, or a readable file path.
     * @returns A base64url-encoded SHA-256 thumbprint string.
     * @throws If the key is not RSA or cannot be parsed.
     */
    static thumbprint(privateKey: string | Buffer): string;
}