/** Options for `revokeRefreshToken`. */
export interface RevokeRefreshTokenOptions {
    /** Revocation endpoint resolved from OIDC discovery. */
    revocationEndpoint: string;
    /** OAuth client ID. */
    clientId: string;
    /** The refresh token to revoke server-side. */
    refreshToken: string;
    /** Aborts the underlying fetch when fired. */
    signal?: AbortSignal;
}
/**
 * Revokes a refresh token via RFC 7009. Servers SHOULD return 200
 * regardless of whether the token was valid (the spec doesn't want
 * revocation to be a probing oracle for token existence). In
 * practice this helper still surfaces network errors and any
 * non-2xx response from the revocation endpoint, on the assumption
 * that a 4xx is more likely a misconfiguration the user should hear
 * about than a routine condition to swallow.
 *
 * Throws a plain `Error` rather than `OAuthFlowError`: revocation
 * is best-effort cleanup invoked from `axe-auth logout`, and the
 * caller already handles failure by warning + continuing with the
 * local clear. Adding a dedicated `OAuthFlowError` code for this
 * one shallow operation is more bloat than the discrimination is
 * worth.
 */
export declare function revokeRefreshToken(options: RevokeRefreshTokenOptions): Promise<void>;