type Refresher = () => Promise<string | undefined>;
/**
 * Marks the gate active. Called from a provider's render body (via a lazy
 * `useState` initializer) so it runs strictly before any child renders or
 * fires a mount effect — otherwise the very requests this exists to catch
 * would slip past while the gate was still disarmed.
 */
export declare function armAuthGate(options?: {
    timeoutMs?: number;
}): void;
/**
 * Mirrors auth state out of Redux so the request path can read it without a
 * React subscription. `accessToken` must be read through here rather than
 * captured in an interceptor closure: an interceptor registered before the
 * bootstrap holds `null`, and it is still the instance running when the gate
 * opens.
 */
export declare function syncAuthGate(state: {
    accessToken: string | null;
    initialized: boolean;
}): void;
/** Registers the bound `requestNewAccessToken` used for pre-emptive rotation. */
export declare function setAuthGateRefresher(refresher: Refresher | undefined): void;
/** Test seam — the module-level state above is shared across a whole run. */
export declare function resetAuthGate(): void;
/**
 * Resolves with the access token a request should carry: null when nobody is
 * signed in, a freshly rotated token when the held one is about to expire,
 * otherwise the held one.
 *
 * Callers must attach the RESULT, not a value captured earlier.
 *
 * `fallbackToken` is what the caller would have sent on its own. While the gate
 * is disarmed — no provider mounted, so nothing is keeping the box in sync —
 * it is returned verbatim, making this a no-op wrapper around the pre-gate
 * behavior rather than a source of silently-null headers.
 */
export declare function getAuthorizedToken(fallbackToken?: string | null): Promise<string | null>;
/**
 * Message thrown by `getAuthorizedTokenForAccount` when the active account
 * changed while a request was parked at the gate. Exported so callers can match
 * on it rather than re-deriving the wording.
 */
export declare const ACCOUNT_SWITCHED_MESSAGE = "The active account changed while this request was waiting. Please try again.";
/**
 * `getAuthorizedToken` for callers that must not have their request re-pointed
 * at a different account.
 *
 * Waiting at the gate makes the token read and the send non-atomic: an account
 * switch during the wait re-closes the gate and reopens it holding the INCOMING
 * account's token, so a parked request resumes under the wrong identity. For a
 * read that is stale data — the tradeoff `axiosPrivate` and `baseApi` already
 * accept. For a WRITE it is worse: a password set on an account the caller never
 * chose (with no current-password check server-side to reject it), or an OAuth
 * provider permanently linked to the wrong account. Those callers use this.
 *
 * Only an actual disagreement throws. A caller that started with no token (cold
 * start — the case the wait exists for) has no identity to compare, and an
 * unreadable `sub` means "don't know" rather than "mismatch"; both proceed,
 * which is the pre-wait behavior. A pre-emptive rotation mints a new token
 * string for the same `sub`, so idle-expiry recovery is unaffected.
 */
export declare function getAuthorizedTokenForAccount(fallbackToken?: string | null): Promise<string | null>;
export {};