/**
 * OAuth refresh-token rotation for stored CLI credentials.
 *
 * Pattern follows `gh`, `supabase`, `vercel`: when the access token is
 * about to expire, swap it transparently using the stored refresh token.
 * The user never re-prompts unless the refresh ALSO fails (revoked,
 * >30 days old, server lost grant), at which point we surface a clear
 * "session expired" error pointing at `lamina login`.
 *
 * Currently preemptive only (refresh BEFORE the request when expiresAt
 * is within the skew window). Adding a reactive 401-retry path is a
 * small follow-up; preemptive handles the common case where the CLI is
 * idle for an hour and the user comes back to a stale token.
 */
import type { StoredLaminaCredentials } from '@uselamina/sdk';
/**
 * Return credentials, refreshed in place if they're OAuth and near
 * expiry. API-key credentials and tokens with plenty of life remaining
 * are returned as-is.
 */
export declare function refreshIfNeeded(creds: StoredLaminaCredentials): Promise<StoredLaminaCredentials>;