import { type TokenSet } from "./tokenResponse";
/** Options for `refreshTokens`. */
export interface RefreshTokensOptions {
    /** Token endpoint resolved from OIDC discovery. */
    tokenEndpoint: string;
    /** OAuth client identifier. */
    clientId: string;
    /** The refresh token to exchange for a new access token. */
    refreshToken: string;
    /** Source of `now`. Defaults to `Date.now`. Injected for test determinism. */
    now?: () => number;
    /** Aborts the underlying fetch when fired. */
    signal?: AbortSignal;
}
/**
 * Exchanges a refresh token for a fresh access token via RFC 6749 §6.
 *
 * Some providers (Keycloak by default) rotate refresh tokens and
 * return a new one in the response; others leave the refresh token
 * alone. When the server omits `refresh_token` from the response,
 * the returned `TokenSet` carries forward the input `refreshToken`
 * so callers never lose refresh capability after one use.
 *
 * @throws {OAuthFlowError} with code `TOKEN_EXCHANGE_FAILED` on any
 *   failure. `details` surfaces the OAuth `error` /
 *   `error_description` when present; callers distinguishing
 *   "refresh revoked" from "network hiccup" should inspect
 *   `details.error === "invalid_grant"`.
 */
export declare function refreshTokens(options: RefreshTokensOptions): Promise<TokenSet>;