/**
 * Token validation cache with TTL+LRU eviction.
 *
 * Google access tokens are opaque (not JWTs), so we must call tokeninfo to check validity.
 * We cache the actual expiry time from Google, plus a buffer for recently-expired tokens.
 *
 * Why validate upfront instead of bubbling up 401s from tool handlers?
 * The MCP SDK wraps all tool errors in JSON-RPC responses with HTTP 200, so clients never
 * see HTTP 401 and don't trigger token refresh. MCP clients rely on HTTP 401 to know when
 * to use their refresh token to get a new access token. By validating upfront, we can
 * return HTTP 401 before the request reaches the SDK, allowing the client to refresh and retry.
 *
 * See: https://github.com/modelcontextprotocol/typescript-sdk/issues/1294
 */
export declare function isTokenValid(token: string): Promise<boolean>;