/**
 * Silent OAuth token refresh — lightweight utility that exchanges an expired
 * access token for a new one using a stored refresh token, without opening
 * the browser or importing heavy dependencies.
 *
 * Returns null on any failure so the caller can fall back to full browser auth.
 */
import { type AmplitudeZone } from '../lib/constants.js';
/**
 * Five minutes in milliseconds — refresh proactively before actual expiry.
 * Exported so other refresh paths (notably the polling refresh inside
 * `DataIngestionCheckScreen`) apply the same skew tolerance and don't 401
 * on users whose laptop clock drifted by a few seconds.
 */
export declare const EXPIRY_BUFFER_MS: number;
/**
 * Attempts a silent OAuth token refresh if the access token is expired or
 * expiring within 5 minutes. Returns new token data on success, or null if
 * refresh is not needed, not possible, or fails.
 */
export declare function tryRefreshToken(storedEntry: {
    accessToken: string;
    refreshToken?: string;
    expiresAt: number;
}, zone?: AmplitudeZone): Promise<{
    accessToken: string;
    expiresAt: number;
    refreshToken?: string;
    /**
     * Refreshed OIDC id_token, when the OAuth server returns one.
     * Ory issues a new id_token on every refresh as long as the original
     * authorization included the `openid` scope. The wizard's API client
     * authenticates with the id_token (not the access token) for every
     * `fetchAmplitudeUser` / `getAPIKey` call, so persisting it is what
     * keeps long-lived sessions working — without it the access token
     * gets refreshed but the next `fetchAmplitudeUser` 401s on a stale
     * id_token, the catch block falls through to `apiKeyNotice`, and
     * the run dies as `auth_required: no_stored_credentials` even
     * though the refresh succeeded.
     */
    idToken?: string;
} | null>;
