import type { CommitResult, ExpectedSession } from './session-mutation';
export declare function getMessageStatement(): Promise<string>;
export declare function createAuthHeader(isServer: boolean): Promise<{
    Authorization: string;
} | null>;
export declare function getUserInfo(isServer: boolean): Promise<any>;
/**
 * The identity fields exposed on the SDK `User` object, derived from a verified
 * idToken. Mirrors the realtime-worker's auth.ts so the client surfaces exactly
 * the same { id, address, email } the backend authenticates as.
 */
export interface UserIdentity {
    /** @user.id — universal stable identity (custom:userId only). */
    id: string | null;
    /** @user.address — REAL Solana wallet; null for email-only / EVM-wallet logins. */
    address: string | null;
    /** @user.email — verified lowercased email; null for wallet/SIWS logins. */
    email: string | null;
    /** @user.evmAddress — REAL EVM wallet, canonical lowercase 0x-hex; null when unlinked. */
    evmAddress: string | null;
}
/**
 * Derive { id, address, email } from an idToken's claims.
 *
 * Mirrors the realtime-worker auth.ts identity resolution so the client-side
 * `user` object matches what the backend authenticates as:
 *   - id  = custom:userId only.
 *   - address = custom:walletAddress only (a REAL wallet). NEVER falls back to the
 *           identity: an opaque id is not a spendable onchain address. null for
 *           email-only sessions.
 *   - email = the token's `email` claim, lowercased to match the canonical form
 *           policy equality compares against. null when absent (wallet/SIWS).
 *
 * Returns all-null when the token can't be decoded (caller treats as no identity).
 */
export declare function deriveUserIdentityFromIdToken(idToken: string | null | undefined): UserIdentity;
export declare function getIdToken(isServer: boolean): Promise<string | null>;
export declare function getRefreshToken(isServer: boolean): Promise<string | null>;
/** The auth issuer base that minted the active client session, so a refresh POSTs
 *  to the right /session/refresh. Undefined on the server (keypair, no refresh). */
export declare function getSessionIssuer(isServer: boolean): string | undefined;
/**
 * Read the active session's generation, minting one for a pre-generation session.
 *
 * The server manager is a single in-memory session per process, so it has no
 * cross-realm lineage problem and reports null.
 */
export declare function getSessionGeneration(isServer?: boolean): Promise<string | null>;
/**
 * Commit refreshed tokens, bound to the generation they were minted for.
 *
 * Replaces the old void-returning `updateIdTokenAndAccessToken`. That version
 * silently dropped a write its cross-principal guard refused, so callers went on
 * to use a token that had NOT been stored — letting a request execute as the
 * previous user while storage and the UI already showed a new one. Callers must
 * branch on the outcome and use `session`, never the token they passed in.
 */
export declare function commitRefreshedTokens(expected: ExpectedSession, idToken: string, accessToken: string, isServer?: boolean, refreshToken?: string): Promise<CommitResult<any>>;