export interface OriginKeyData {
    originKey: CryptoKey;
    expiresAt: number;
}
/**
 * Manages origin-bound keys for session security.
 * Single responsibility: origin key lifecycle management.
 * Self-contained implementation using IndexedDB directly.
 */
export declare class OriginKeyManager {
    private dbName;
    private dbVersion;
    private storeName;
    private namespace;
    /**
     * Namespace isolates origin keys per LNC instance.
     */
    constructor(namespace: string);
    /**
     * Check whether the stored origin key is past its validity window.
     */
    isExpired(expiresAt: number): boolean;
    /**
     * Return a usable origin key, creating and persisting one if needed.
     */
    getOrCreateOriginKey(): Promise<OriginKeyData>;
    /**
     * Load the origin key for this namespace from IndexedDB.
     */
    loadOriginKey(): Promise<OriginKeyData | undefined>;
    /**
     * Persist the origin key and expiry metadata for this namespace.
     */
    saveOriginKey(originKey: CryptoKey, expiresAt: number): Promise<void>;
    /**
     * Remove this namespace's origin key record from IndexedDB.
     */
    clearOriginKey(): Promise<void>;
    /**
     * Open a database connection, run the callback, and always close the handle.
     * Separating open/close from business logic keeps each caller's try/catch
     * free of a finally block, which avoids an untestable v8 coverage branch.
     */
    private withDB;
    /**
     * Open (or create/upgrade) the IndexedDB database used to persist
     * origin-bound keys for this namespace.
     */
    private openDB;
}
//# sourceMappingURL=OriginKeyManager.d.ts.map