type CookieOptions$1 = {
    domain?: string | undefined;
    path?: string | undefined;
    secure?: boolean | undefined;
    httpOnly?: boolean | undefined;
    sameSite?: "lax" | "strict" | "none" | undefined;
    /**
     * Seconds.
     */
    maxAge?: number | undefined;
    expires?: Date | undefined;
};

type CookieOptions = CookieOptions$1;

/**
 * "Trusted device" cookie — long-lived, opaque, HMAC-authenticated
 * cookie separate from the session cookie. The classic use case is the
 * 2FA "remember this device for 30 days" tick-box: on subsequent logins
 * the caller can skip the TOTP prompt when this cookie is present and
 * valid.
 *
 * Deliberately kept independent from `createSessionManager` — the two
 * live at different scopes (the session cookie is per-session, the
 * trusted-device cookie is per-user across many sessions), so they
 * don't share config or a store.
 *
 * @param {{
 *   secret:   string | Buffer | Uint8Array | Array<string | Buffer | Uint8Array>,
 *   ttl:      string | number,           // e.g. '30d'
 *   cookie?:  Omit<import('./cookie.js').CookieOptions, 'maxAge' | 'expires'> & { name?: string },
 * }} config
 */
declare function createTrustedDeviceCookie(config: {
    secret: string | Buffer | Uint8Array | Array<string | Buffer | Uint8Array>;
    ttl: string | number;
    cookie?: Omit<CookieOptions, "maxAge" | "expires"> & {
        name?: string;
    };
}): {
    /**
     * Mint a trusted-device cookie for a user. Call this at 2FA completion
     * when the user ticked "remember me on this device".
     *
     * `extraClaims` keys named `uid`, `iat`, or `exp` are ignored — the
     * reserved fields always win.
     *
     * @param {string} userId
     * @param {{ now?: number, extraClaims?: object }} [options]
     * @returns {string}   Set-Cookie header value.
     */
    issue(userId: string, options?: {
        now?: number;
        extraClaims?: object;
    }): string;
    /**
     * Check whether the incoming request carries a trusted-device
     * cookie belonging to `userId`. Returns `true` on a valid,
     * unexpired, correctly-scoped cookie; `false` otherwise. Never
     * throws.
     *
     * @param {any} req
     * @param {string} userId
     * @param {{ now?: number }} [options]
     * @returns {boolean}
     */
    verify(req: any, userId: string, options?: {
        now?: number;
    }): boolean;
    /**
     * Produce a delete-cookie header value — call this on explicit
     * logout / "forget this device" flows.
     * @returns {string}
     */
    revoke(): string;
    readonly cookieName: string;
};

export { createTrustedDeviceCookie };