import type { PathCtx } from '../config/paths.js';
export type RefreshStatus = 'refreshed' | 'not-needed' | 'needs-login' | 'unavailable';
export interface RefreshOutcome {
    status: RefreshStatus;
    detail?: string;
    /**
     * True when this verdict was remembered rather than newly discovered, so a
     * caller can report it once instead of on every check.
     */
    alreadyKnown?: true;
}
export interface RefreshOptions {
    now?: () => number;
    fetchImpl?: typeof fetch;
    tokenUrl?: string;
    clientId?: string;
    /**
     * Where ccx keeps its state, so a refusal is written where a LATER process
     * will find it. Without it the note is skipped rather than written somewhere
     * unintended, which is why nothing here defaults to the real config home.
     */
    ctx?: PathCtx;
}
/**
 * Is this login expired, or close enough that it would be renewed now?
 *
 * Exported so a caller that must NOT renew (a profile sharing its login with
 * another) can still tell whether a renewal would have happened, and report that
 * once instead of on every check.
 */
export declare function renewalIsDue(accountDir: string, now?: () => number): boolean;
/**
 * Has this login been dead long enough that nothing can be using it?
 *
 * Used to decide when it is safe to renew a login ccx does not control (an editor
 * session reads one directly, and ccx cannot see that it is running). A live
 * Claude refreshes its own token within minutes of expiry, so a token that has
 * been expired far longer than that is not being held by anything, and renewing
 * it is both safe and the only way to keep its usage readable.
 */
export declare function expiredLongerThan(accountDir: string, graceMs: number, now?: () => number): boolean;
/** Renew `accountDir`'s token if it is expired (or about to be). */
export declare function refreshCredentialIfExpired(accountDir: string, options?: RefreshOptions): Promise<RefreshOutcome>;
export declare const REFRESH_EXPIRY_BUFFER_MS: number;