/**
 * Extract the `custom:walletAddress` claim from a JWT idToken. Returns undefined
 * when the token has no wallet claim or cannot be decoded.
 */
export declare function idTokenWalletAddress(idToken: string, decodeBase64Url: (input: string) => string): string | undefined;
/**
 * Whether a refreshed idToken may be grafted onto the CURRENTLY-stored session.
 *
 * A silent refresh started for user A can complete after storage was replaced
 * with user B (a login, guest→wallet upgrade, or a cross-tab login). Overwriting
 * B's tokens with A's — the app-id matches, so the old guard let it through —
 * installs a genuine-but-WRONG session: the UI shows B while the app authenticates
 * as A (#220 / #221). Refuse the write when the refreshed token binds to a
 * DIFFERENT wallet than the one currently stored. A tokenless/addressless session
 * (guest / opaque) preserves the prior behavior (returns true).
 */
export declare function refreshedTokenMayReplaceStored(newIdToken: string, storedAddress: string | undefined, decodeBase64Url: (input: string) => string): boolean;