import { AuthTokenPair, JwtClaims } from './models/auth-api.model';
export type SessionStatus = 'unknown' | 'restoring' | 'authenticated' | 'unauthenticated' | 'expired';
/**
 * Holds the Ed25519-flow JWT/refresh-token pair and derived claims. Separate
 * from the telegram module's AdminAuthService (Telegram-session state) by
 * design - the two auth mechanisms are not merged until both ship on the
 * same backend and a migration decision is made.
 */
export declare class SessionService {
    private readonly jwt;
    private readonly tokenSignal;
    private readonly refreshTokenSignal;
    private readonly claimsSignal;
    private readonly statusSignal;
    readonly token: import("@angular/core").Signal<string | null>;
    readonly claims: import("@angular/core").Signal<JwtClaims | null>;
    readonly status: import("@angular/core").Signal<SessionStatus>;
    readonly isAuthenticated: import("@angular/core").Signal<boolean>;
    readonly role: import("@angular/core").Signal<import("..").AdminRole | null>;
    private refreshTimer?;
    private refreshCallback?;
    /** Called once by AuthService on init to wire up the refresh trigger without a circular DI dependency. */
    onRefreshDue(callback: () => void): void;
    /** Restores session state from persisted storage. Returns true if a (possibly expired) session was found. */
    restore(): boolean;
    activate(tokens: AuthTokenPair): void;
    getRefreshToken(): string | null;
    markExpired(): void;
    clear(): void;
    private scheduleRefresh;
    private clearRefreshTimer;
    private readStorage;
    private writeStorage;
    private removeStorage;
}