import { type CommitResult, type ExpectedSession } from "./session-mutation";
export declare class WebSessionManager {
    private static establishmentEpoch;
    private static scopedStorageKey;
    private static get BOUNDED_SESSION_STORAGE_KEY();
    private static logoutKey;
    /** Capture before login's network work; checked under the session mutation lock. */
    static captureSessionEstablishment(): () => void;
    /** Raw read of the stored blob. Callers inside the lock use this, never a cached copy. */
    private static readRaw;
    private static writeRaw;
    /**
     * Read the session, stamping a `sessionGeneration` if it predates them.
     *
     * Sessions written before generations existed have no lineage marker, so a
     * later refresh could not prove it descended from them. Minting on read
     * upgrades them in place; a request already in flight across that mint carries
     * no generation and fails closed at commit rather than writing unprovably.
     */
    static readSessionWithGeneration(): Promise<any | null>;
    /**
     * Decode a base64url-encoded string (used by JWT payloads).
     * Normalises base64url → standard base64 before calling browser atob().
     */
    private static decodeBase64Url;
    static storeSession(address: string, accessToken: string, idToken: string, refreshToken: string, issuer?: string, beforeCommit?: () => void): Promise<(() => Promise<void>) | undefined>;
    static getSession(): Promise<{
        address: string;
        session: any;
    } | null>;
    /**
     * Remove the session unconditionally (logout, app-id mismatch, dead refresh).
     *
     * ASYNC AND LOCKED, and callers MUST await it. Two failure modes hang on this:
     *
     *  - Removing outside the lock lets a refresh that read before the logout write
     *    the session back afterwards, resurrecting a logged-out session.
     *  - Not awaiting lets `logout()` return while the credential is still in
     *    storage, so the very next request authenticates as the user who just left.
     */
    static clearSession(): Promise<void>;
    /**
     * Remove the session only if it is still the one identified by `generation`.
     *
     * Used by every failure path that wants to drop a dead session without
     * trampling a newer login that landed while the failure was in flight.
     */
    static clearSessionIfGeneration(generation: string | null): Promise<void>;
    static isAuthenticated(): boolean;
    static getIdToken(): string | null;
    static getRefreshToken(): string | null;
    /** The issuer base that minted this session (for routing silent refresh). */
    static getIssuer(): string | null;
    /**
     * Commit refreshed tokens, bound to the session generation they were minted for.
     *
     * Returns WHICH of the four outcomes happened, and the session the caller must
     * actually use. The old version returned void and silently dropped a refused
     * write, so `getFreshAuthToken` handed back the refreshed token regardless — a
     * request could then execute as the previous user while storage and the UI had
     * already moved to a new one.
     *
     * Never hand back `idToken` directly: use `result.session`.
     */
    static commitRefreshedTokens(expected: ExpectedSession, idToken: string, accessToken: string, refreshToken?: string): Promise<CommitResult<any>>;
}