/**
 * Token refresh client for WorkOS OAuth
 */
export interface RefreshResult {
    success: boolean;
    accessToken?: string;
    refreshToken?: string;
    expiresAt?: number;
    error?: string;
    errorType?: 'invalid_grant' | 'network' | 'server' | 'unknown';
}
/**
 * Refresh access token using stored refresh token.
 *
 * @param authkitDomain - The AuthKit domain (e.g., https://auth.workos.com)
 * @param clientId - OAuth client ID
 * @returns RefreshResult with new tokens or error details
 */
export declare function refreshAccessToken(authkitDomain: string, clientId: string): Promise<RefreshResult>;
/**
 * Check if token needs refresh (expires within threshold).
 */
export declare function tokenNeedsRefresh(expiresAt: number, thresholdMs?: number): boolean;