/**
 * When the access JWT has fewer than this many seconds until `exp`, call the proxy refresh endpoint.
 * Matches desktop `checkAuth` behavior (300 seconds).
 */
export declare const ACCESS_TOKEN_PROACTIVE_REFRESH_THRESHOLD_SECONDS = 300;
/**
 * Returns seconds until JWT `exp`, or null when the token cannot be decoded.
 */
export declare const getJwtSecondsUntilExpiry: (accessToken: string) => number | null;
/**
 * Returns the JWT `sub` claim (Supabase user id), or null when the token cannot
 * be decoded. No signature verification — callers use this only to recover the
 * canonical user id from a token we already trust locally.
 */
export declare const getJwtSub: (accessToken: string) => string | null;
/**
 * Decodes the user's display name from a Supabase access token's payload. For
 * OAuth sign-ins Supabase copies the provider profile into `user_metadata`, so
 * Google logins carry `full_name`/`name` here (separate given/family names live
 * in identity_data, which isn't in the token). No signature verification — we
 * already trust the locally-stored token, same as {@link getJwtSub}.
 */
export declare const getJwtDisplayName: (accessToken: string) => string | null;
/**
 * Returns true when the access token should be refreshed before use (expired, unreadable, or within threshold).
 */
export declare const shouldProactivelyRefreshAccessToken: (accessToken: string, thresholdSeconds?: number) => boolean;
/**
 * Exchanges a refresh token for new credentials using the Rivet proxy `/api/auth/refresh` endpoint.
 */
export declare const refreshAccessTokenViaProxy: (params: {
    refreshToken: string;
    proxyUrl: string;
    fetchImpl?: typeof fetch;
}) => Promise<{
    token: string;
    refreshToken?: string;
} | null>;
export type HostedDemoProxyRefreshResult = {
    token: string;
    refreshToken?: string;
} | null;
/**
 * Runs at most one in-flight hosted-demo token refresh per session id.
 * Concurrent requests share the same promise so the proxy refresh endpoint is not hit in parallel with the same refresh token.
 */
export declare const runHostedDemoTokenRefreshSingleFlight: (sessionId: string, refresh: () => Promise<HostedDemoProxyRefreshResult>) => Promise<HostedDemoProxyRefreshResult>;
/** Clears in-flight refresh state. Intended for tests only. */
export declare const resetHostedDemoTokenRefreshSingleFlightForTests: () => void;
//# sourceMappingURL=accessTokenRefresh.d.ts.map