import { type Clock } from '../../utils/clock.ts';
/**
 * Caches a short-lived access token, refreshing before expiry.
 *
 * Subclasses implement `refreshPair` with their provider's grant. An
 * in-flight refresh is shared so concurrent callers cost one round-trip,
 * and `bufferSeconds` refreshes early so a token never expires
 * mid-request.
 *
 * Expiry is read on `clock`, which also times the waits between retries of
 * the calls the manager signs. A mount hands it the workspace's clock
 * through `bindClock` and gives it back through `releaseClock`; absent is
 * the system clock.
 */
export declare abstract class TokenManager {
    private accessToken;
    private expiresAt;
    private inflight;
    private readonly bufferSeconds;
    clock: Clock;
    /** Seconds a call the manager signs may stall; absent is the client default. */
    readonly timeout: number | undefined;
    private readonly holders;
    constructor(bufferSeconds?: number, clock?: Clock, timeout?: number);
    /**
     * Read expiry and time retry waits on `clock` while `owner` holds the
     * manager. A workspace holds it from the moment its mounts take its clock
     * until it unmounts the VFS or closes; holding again, or letting go twice,
     * changes nothing. Expiry and waits can follow one clock only, so while
     * another owner holds the manager a different clock is refused; two system
     * clocks agree. A refreshed token's expiry was read on the clock it
     * replaces, so it is dropped and the next call refreshes; a seeded token
     * that never expires is kept.
     *
     * @param owner who holds it, released by the same key.
     * @throws Error when another owner holds the manager on another clock.
     */
    bindClock(clock: Clock, owner: unknown): void;
    /** Let `owner` go; once none holds, another clock may bind. */
    releaseClock(owner: unknown): void;
    /** Fetch a fresh token as `[accessToken, expiresInSeconds]`. */
    protected abstract refreshPair(): Promise<[string, number]>;
    /**
     * Preload the cache with a token minted outside the refresh flow.
     * `expiresAt` is epoch seconds after which `getToken` refreshes again;
     * pass `Number.POSITIVE_INFINITY` for a token the manager can never
     * replace itself.
     */
    protected seed(token: string, expiresAt: number): void;
    /**
     * The token, refreshed when it is due. `signal` is the waiting call's: its
     * stop ends its own wait, and a refresh it started answers to it.
     */
    getToken(signal?: AbortSignal): Promise<string>;
    private refresh;
}
//# sourceMappingURL=oauth.d.ts.map