/**
 * Catalog `<img>` 404s are terminal for that media identity while the HMAC
 * signature is still valid. Invalidating the catalog on every `onError` remints
 * `sig`/`exp` (or remounts cards), which retriggers the request and creates a
 * customer/kiosk ↔ API retry storm.
 *
 * Expired signed URLs get exactly one remint retry: the identity is held in
 * `remintPendingKeys` (hiding the expired URL) until a fresh unexpired URL is
 * seen; a second failure then moves the identity to `brokenCatalogImageKeys`.
 *
 * Identity ignores `sig`, `exp`, and cache-bust `v` so a reminted URL for the
 * same blob cannot bypass the terminal broken set.
 */
export declare function catalogImageFailureKey(url: string): string;
export declare function isCatalogImageSignatureExpired(url: string, nowMs?: number): boolean;
export declare function isBrokenCatalogImageUrl(url: string | null | undefined, nowMs?: number): boolean;
/**
 * Record a catalog image load failure.
 * - `emitTelemetry` once per media identity (avoids analytics 422 storms).
 * - `refreshCatalog` only on the first expired signed failure — reminted URLs
 *   get one attempt; a second failure is terminal.
 */
export declare function noteCatalogImageLoadFailure(url: string, nowMs?: number): {
    refreshCatalog: boolean;
    emitTelemetry: boolean;
};
/** Test-only — session guard must not leak across specs. */
export declare function clearCatalogImageLoadGuardForTests(): void;
//# sourceMappingURL=catalogImageLoadGuard.d.ts.map