import type { Session } from "./session.js";
/** The response a guard denies a missing session with, in place of the default `401` JSON. */
export interface UnauthenticatedResponse {
    /** An error status, 400-599. Default `401`. */
    readonly status?: number;
    /** The body; present but `undefined` sends none. Default `{ ok: false, error: "unauthorized" }`. */
    readonly body?: unknown;
    /** Response headers, such as a `www-authenticate` challenge. */
    readonly headers?: Readonly<Record<string, string>>;
}
/** What a guard does when the check fails: 302 to `redirectTo` (a same-origin path), or - omitted - the
 * `unauthenticated` response, by default a 401 JSON (`{ ok: false, error: "unauthorized" }`). */
export interface GuardOptions {
    readonly redirectTo?: string;
    readonly unauthenticated?: UnauthenticatedResponse;
}
/**
 * Require a non-empty session. Returns it when present; otherwise throws a `status(...)` render
 * (302/401) - control flow, not a `Response`; see the module docs above. Use at
 * the top of a protected loader:
 * `const session = requireSession(await sessions.get(c), { redirectTo: "/login" })`.
 *
 * Non-empty is not signed in: a session that holds anything (a cart, a return path, CSRF state)
 * passes. Guard a page for signed-in visitors with {@link requireUser} and the key a login sets.
 */
export declare function requireSession<Data extends Record<string, unknown>>(session: Session<Data>, options?: GuardOptions): Session<Data>;
/**
 * Require a specific session key (e.g. the `userId` a login set) to be present. Returns its value
 * (narrowed non-nullish); otherwise throws like {@link requireSession}. The common "who is the user"
 * guard: `const userId = requireUser(await sessions.get(c), "userId", { redirectTo: "/login" })`.
 */
export declare function requireUser<Data extends Record<string, unknown>, K extends keyof Data>(session: Session<Data>, key: K, options?: GuardOptions): NonNullable<Data[K]>;
//# sourceMappingURL=guards.d.ts.map