import type { SubscriptionManager } from './subscriptions.js';
/**
 * The stored access token for a provider, or null when no subscription is
 * recorded. Deliberately does NOT refresh a near-expiry OpenAI token any
 * more: the provider's own 401 path owns refresh uniformly (see
 * {@link refreshOpenAISubscriptionAfterRejection}), so an expired token costs
 * one rejected request and then recovers through the same code that handles
 * a mid-lifetime revocation. Two refresh paths was how the expiry path came
 * to throw a raw token-exchange error that the surfaces then captioned as an
 * API-key problem.
 */
export declare function resolveSubscriptionAccessToken(provider: string, manager: Pick<SubscriptionManager, 'get' | 'saveSubscription' | 'resolveAccessToken'>): Promise<string | null>;
/**
 * What one recovery attempt concluded. `refreshed` carries the token to retry
 * with (possibly minted by a concurrent caller rather than this one).
 * `session-dead` means the authorization server refused the grant: the
 * session is over and only a new sign-in helps. `unavailable` means the
 * refresh could not be judged (transport failure, a 5xx from the token
 * endpoint, a malformed answer): the session's true state is unknown and the
 * caller must NOT tell the user to sign in again.
 */
export type SubscriptionRefreshOutcome = {
    readonly kind: 'refreshed';
    readonly accessToken: string;
} | {
    readonly kind: 'session-dead';
} | {
    readonly kind: 'unavailable';
    readonly error: unknown;
};
/**
 * One recovery attempt for a stored OpenAI subscription whose access token
 * the backend has rejected. `rejectedAccessToken` is the token the backend
 * refused: when the store already holds a DIFFERENT token, another caller
 * (or another process) refreshed while this one was in flight, and the
 * stored token is returned without spending anything.
 *
 * The exchange is time-bounded (oauth-core) but deliberately not wired to
 * any one turn's abort signal: the attempt is shared by every concurrent
 * caller, and one caller cancelling its turn must not abort the recovery
 * the others are awaiting.
 */
export declare function refreshOpenAISubscriptionAfterRejection(manager: Pick<SubscriptionManager, 'get' | 'saveSubscription'>, rejectedAccessToken: string): Promise<SubscriptionRefreshOutcome>;
/**
 * Interaction-free freshness maintenance, called before a send: a token at
 * or near its expiry is refreshed silently with the rotating refresh token,
 * so the ordinary expiry case never even produces a rejected request, let
 * alone a user-visible error. `unavailable` falls back to the stored token;
 * the send may still work, and the rejection path backstops it if not.
 */
export declare function resolveFreshOpenAIAccessToken(manager: Pick<SubscriptionManager, 'get' | 'saveSubscription'>): Promise<SubscriptionRefreshOutcome | {
    kind: 'unconfigured';
}>;
//# sourceMappingURL=subscription-auth.d.ts.map