import type { ArkmeSessionCredentials } from './keychain-store.js';
import { SecretValue } from './secret-value.js';
export interface ManagedAccessCredentialProvider {
    resolveManagedAccessCredential(): Promise<SecretValue>;
}
export interface ManagedAccessCredentialRuntime {
    requireSession(): Promise<ArkmeSessionCredentials>;
    refreshAccessToken(session: ArkmeSessionCredentials): Promise<ArkmeSessionCredentials>;
}
/** Resolve a current Host-owned Access credential without exposing refresh credentials to consumers. */
export declare function resolveManagedAccessCredential(runtime: ManagedAccessCredentialRuntime, refreshWindowMillis?: number): Promise<SecretValue>;
/** Treat a parseable JWT expiry as a refresh hint; opaque Access credentials remain usable. */
export declare function managedAccessTokenExpiresWithin(accessToken: string, windowMillis: number, nowMillis?: number): boolean;
//# sourceMappingURL=managed-access-credential.d.ts.map