/** Accessors each door passes from its own config module (both hit the same file). */
export interface RefreshDeps {
    getApiUrl: () => string;
    getJwt: () => string | undefined;
    getEmail: () => string | undefined;
    getRefreshToken: () => string | undefined;
    writeConfig: (data: {
        accessToken?: string;
        refreshToken?: string;
    }) => void;
}
/**
 * Rotate the WorkOS session after a 401. Adopts a peer's concurrently-rotated
 * pair when one exists (same identity), otherwise mints a fresh pair under the
 * lock and persists it. Returns true when the caller should retry the request
 * (we rotated, or a same-identity peer already had). `entryEmail` is the identity
 * the caller was operating as when it captured `usedAccessToken`, so a mid-flight
 * account switch can never be mistaken for a rotation.
 */
export declare function tryRefreshToken(deps: RefreshDeps, usedAccessToken: string | undefined, entryEmail: string | undefined): Promise<boolean>;
export declare function __resetLockStateForTests(): void;
//# sourceMappingURL=token-refresh.d.ts.map