/**
 * In-memory session JWT manager for lit-ops-server.
 *
 * The server's `POST /api/auth/login` route accepts an EIP-712-signed
 * `DhServerLogin` envelope and returns an HS256 JWT with a 15-minute TTL.
 * This helper:
 *
 *   - caches the JWT until ~30s before expiry,
 *   - coalesces concurrent callers behind a single in-flight Promise so we
 *     don't spam `/api/auth/login` on parallel SDK calls,
 *   - exposes `getValidToken()` returning the live token and
 *     `getAuthHeader()` returning a ready-to-spread `{ Authorization: ... }`
 *     object.
 *
 * Browser-safe — no filesystem touches. The CLI mirrors this shape but
 * persists to `~/.diamond-hands/session.json` for cross-invocation reuse.
 */
import type { Signer } from "ethers";
export interface ServerSessionOptions {
    signer: Signer;
    serviceEndpoint: string;
    chainId: number;
    /** Override for tests. */
    now?: () => number;
    /** Override for tests. */
    fetchImpl?: typeof fetch;
}
export declare class ServerSession {
    private readonly signer;
    private readonly serviceEndpoint;
    private readonly chainId;
    private readonly now;
    private readonly fetchImpl;
    private cached;
    private inFlight;
    constructor(opts: ServerSessionOptions);
    /** Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds. */
    getValidToken(): Promise<string>;
    /** Convenience for fetch: spread directly into `headers`. */
    getAuthHeader(): Promise<Record<string, string>>;
    /** Drop the cached token (e.g. on 401 from server). Next call re-logs in. */
    clear(): void;
    /**
     * Revoke the current session JWT on lit-ops-server (`POST /api/auth/logout`).
     * Clears the local cache regardless of server response so the client stops
     * presenting the token.
     */
    logout(): Promise<void>;
    private getOrRefresh;
}
