/**
 * What both sign-in channels hand to `establishSession`. The refresh token is
 * optional: the identity provider only issues one when the application has the
 * refresh grant enabled.
 */
export type IdentityTokens = {
    accessToken: string;
    refreshToken: string | undefined;
    /** Epoch milliseconds at which `accessToken` stops being accepted. */
    expiresAt: number;
};
export type Auth0ErrorBody = {
    error?: string;
    error_description?: string;
};
/**
 * Throws rather than calling `failWith` so the device-flow poll can treat a
 * blip as a retryable iteration instead of losing an in-progress sign-in.
 */
export declare function postToAuth0(opts: {
    path: string;
    body: URLSearchParams | Record<string, unknown>;
    timeoutMs?: number;
}): Promise<Response>;
export declare function parseTokenResponse(json: unknown): IdentityTokens;
/**
 * Falls back to the raw text: a gateway or WAF in front of the provider answers
 * with HTML, and "no response body" would throw away the only clue about why.
 */
export declare function readErrorBody(response: Response): Promise<Auth0ErrorBody | string | undefined>;
export declare function describeError(body: Auth0ErrorBody | string | undefined): string;
export declare function errorCodeOf(body: Auth0ErrorBody | string | undefined): string | undefined;
//# sourceMappingURL=auth0.d.ts.map