import { type RefreshableSession, type StoredCredentials } from "./credentials.js";
export declare const SESSION_EXPIRED_MESSAGE = "Your session has expired. Sign in again with \"cargo-ai login --email <email>\" (no browser needed) or \"cargo-ai login --oauth\".";
/**
 * Thrown when the session cannot be renewed at all, so callers can exit with
 * the "not authenticated" code rather than a generic failure. Expiry is the
 * ordinary way to lose a session, so scripts need to recognise it.
 */
export declare class SessionExpiredError extends Error {
    constructor();
}
export type AccessTokenProvider = (forceRefresh?: boolean) => Promise<string>;
/**
 * Exchanges a refresh token for a fresh access token. The returned refresh
 * token is `undefined` unless the tenant rotates them, in which case the new
 * one replaces the old and the old stops working.
 */
export declare function refreshSession(session: RefreshableSession): Promise<{
    accessToken: string;
    refreshToken: string | undefined;
    expiresAt: number;
}>;
/**
 * Invalidates the refresh token at the tenant, so signing out cannot be undone
 * by anyone who kept a copy of the credentials file. Throws on failure; the
 * caller decides whether that is worth reporting.
 */
export declare function revokeSession(session: RefreshableSession): Promise<void>;
/**
 * Resolves the access token for each request, renewing the session when it is
 * about to expire. Long-running callers (the MCP bridge) therefore keep
 * working past the original token's lifetime without reconnecting.
 *
 * `reload` and `persist` are injectable for tests; in production they are the
 * credentials file, which is also how two concurrent processes stay in step.
 */
export declare function createAccessTokenProvider(opts: {
    credentials: StoredCredentials;
    reload?: () => StoredCredentials | undefined;
    persist?: (credentials: StoredCredentials) => void;
}): AccessTokenProvider;
/**
 * One provider per credential per process. A command that builds more than one
 * API client (the MCP bridge builds two) would otherwise get two providers,
 * each with its own single-flight guard, and they would race to renew the same
 * session.
 */
export declare function getSharedAccessTokenProvider(credentials: StoredCredentials): AccessTokenProvider;
/** Test seam: providers are process-wide, so suites must not inherit them. */
export declare function resetSharedAccessTokenProviders(): void;
//# sourceMappingURL=accessToken.d.ts.map