/**
 * OAuth refresh helper used by capability providers (Codex / Anthropic /
 * future Google OAuth). Standalone from `resolveApiKeyForProvider` because
 * refresh is an async network call; the sync hot path never invokes it.
 *
 * Usage pattern:
 *
 * ```typescript
 * const profile = store.get('openai', 'codex');
 * if (profile?.mode === 'oauth' && isOAuthAccessTokenExpired(profile)) {
 *   const fresh = await refreshOAuthProfile(profile, { http: postJsonRequest });
 *   await store.save?.(fresh);
 * }
 * ```
 */
import type { AuthProfile } from './types.js';
export interface OAuthRefreshOptions {
    /**
     * HTTP transport. Defaults to global `fetch`. Tests inject a mock;
     * production usually uses the SSRF-protected `postJsonRequest` from
     * `src/media-shared/http/`.
     */
    fetcher?: typeof fetch;
    /** Hard timeout for the refresh request (ms). Default 30s. */
    timeoutMs?: number;
}
export declare function isOAuthAccessTokenExpired(profile: AuthProfile, nowMs?: number): boolean;
/**
 * Refresh an OAuth access token using the standard refresh-token grant. The
 * vendor must have set `oauthTokenEndpoint` and `oauthRefreshToken` on the
 * profile when it was first persisted.
 *
 * Returns a new {@link AuthProfile} object — does NOT mutate the input. The
 * caller is responsible for `store.save?.(returned)`.
 */
export declare function refreshOAuthProfile(profile: AuthProfile, options?: OAuthRefreshOptions): Promise<AuthProfile>;