import type { BffSession, IBffSessionStore } from './session.js';
import type { OidcClient } from './oidc.js';
import type { ResolvedBffOptions } from './options.js';
import type { IBffTenantResolver } from './tenant.js';
/** Keeps a session's access token fresh, refreshing single-flight per session so concurrent requests never
 * each spend the (rotating) refresh token. Re-resolves the session's tenant so each refresh hits the right
 * auth host + confidential client. */
export declare class RefreshCoordinator {
    private readonly tenants;
    private readonly oidcFor;
    private readonly store;
    private readonly o;
    private readonly inflight;
    constructor(tenants: IBffTenantResolver, oidcFor: (authority: string) => OidcClient, store: IBffSessionStore, o: ResolvedBffOptions);
    /** Returns the session with a valid access token, refreshing if near expiry; null if it can no longer be
     * kept valid (treat as logged out). */
    ensureFresh(session: BffSession): Promise<BffSession | null>;
    /** How long a replica may hold a session's refresh lock — a token round trip, not much more. */
    private static readonly LOCK_TTL_MS;
    private doRefresh;
    /**
     * Polls for the lock holder's freshly stored session.
     *
     * Bounded: if the holder crashes mid-redemption its lock expires and the next request retries, which is
     * better than this one redeeming concurrently and losing the whole grant family.
     */
    private awaitHoldersResult;
    private redeemAsync;
    private needsRefresh;
}