import type { ILogger } from '@dynamic-labs-wallet/core';
/** Predicate matching `retryPromise`'s `shouldRetry` option. */
type ShouldRetry = (error: unknown, attempt: number) => boolean | Promise<boolean>;
/**
 * Datadog event name emitted on every signed-session nonce rejection (a 400
 * from the backup/recovery endpoints). Log-only: lets us split the failure
 * bucket by `reason` and measure the true per-wallet unrecoverable rate
 * without changing any retry behavior. See DYNT-1599.
 */
export declare const NONCE_FAILURE_EVENT = "waas.signed_session.nonce_failure";
/**
 * Coarse cause of a signed-session nonce rejection. `invalid_nonce_signature`
 * (a bad/stale signing key) cannot be fixed by refreshing the nonce, whereas
 * `nonce_already_used` (a consumed replay nonce) can — so splitting them tells
 * us whether the refresh-and-retry path can actually help.
 */
export type NonceFailureReason = 'invalid_nonce_signature' | 'nonce_already_used' | 'other';
/** Maps the server error `code`/`message` onto a {@link NonceFailureReason}. */
export declare const classifyNonceFailure: ({ code, message }: {
    code?: string;
    message?: string;
}) => NonceFailureReason;
/**
 * Owns everything about signed sessions and their single-use replay nonces:
 * resolving a session from an explicit value or the host reverse channel,
 * deciding whether the SDK version requires one, and building the
 * refresh-on-replay-400 retry predicate shared by the backup and recovery
 * flows.
 *
 * Extracted from `DynamicWalletClient` so this logic can be exercised in
 * isolation. The host callback is read lazily (`getCallback`) so it stays in
 * sync with the owning client even if reassigned after construction.
 */
export declare class SignedSessionManager {
    private readonly logger;
    private readonly getCallback;
    private readonly sdkVersion?;
    private readonly required;
    private readonly reverseChannelSupported;
    constructor({ logger, sdkVersion, getCallback, }: {
        logger: ILogger;
        sdkVersion?: string;
        getCallback: () => (() => Promise<string>) | undefined;
    });
    /** True when a reverse channel is configured to mint fresh signed sessions. */
    get canRefresh(): boolean;
    /**
     * Resolves the signed session ID from an explicit value or falls back to the
     * host reverse channel. Throws if neither source provides a value.
     */
    resolve(signedSessionId?: string): Promise<string>;
    /** Whether the configured SDK version requires a signed session ID. */
    isRequired(): boolean;
    /** Whether the host SDK version supports the getSignedSessionId reverse channel (see version-check.ts). */
    supportsReverseChannel(): boolean;
    /**
     * Builds a `retryPromise` `shouldRetry` predicate that refreshes a consumed
     * single-use nonce via the reverse channel on a replay 400 and retries once.
     * The signed session carries a single-use replay nonce: it is valid on its
     * first use, but once consumed (e.g. by a preceding operation) the server
     * rejects with a 400, at which point a fresh session is fetched and the call
     * retried. `alsoRetry` lets callers opt into additional retryable statuses
     * (e.g. 429 / 5xx) on top of the nonce refresh.
     */
    refreshShouldRetry({ onRefreshed, operationName, logContext, alsoRetry, }: {
        onRefreshed: (signedSessionId: string) => void;
        operationName: string;
        logContext?: Record<string, unknown>;
        alsoRetry?: (status: number | undefined) => boolean;
    }): ShouldRetry;
    /**
     * Emits a single Datadog log per signed-session nonce rejection so the
     * failure bucket can be split by `reason` and correlated per wallet/request.
     * Purely observational — it never alters the retry decision.
     */
    private instrumentNonceFailure;
}
export {};
//# sourceMappingURL=signedSession.d.ts.map