import type { FastifyRequest } from 'fastify';
import type { WebSocket } from 'ws';
import { TrustedDeviceStore, type TrustedDeviceIssue } from './device-store.js';
import { type WebAccessConfig } from './access.js';
export interface BrowserSession {
    id: string;
    csrf: string;
    createdAt: number;
    lastSeenAt: number;
    absoluteExpiresAt: number;
}
export interface AuthResult {
    session: BrowserSession;
    device: TrustedDeviceIssue;
}
interface Ticket {
    value: string;
    sessionId: string;
    purpose: 'events' | 'conversation';
    roleId?: string;
    expiresAt: number;
}
export declare class WebAuth {
    private _origin;
    private _host;
    private readonly now;
    private readonly devices;
    private readonly access;
    private _bootstrapSecret;
    private bootstrapExpiresAt;
    private bootstrapUsed;
    private readonly sessions;
    private readonly sessionDevices;
    private readonly tickets;
    private readonly rates;
    private readonly sockets;
    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig);
    get bootstrapSecret(): string;
    get origin(): string;
    get host(): string;
    get mode(): WebAccessConfig['mode'];
    get secureCookies(): boolean;
    private allowedOrigins;
    private allowedHosts;
    setBoundary(origin: string, host: string, aliases?: {
        origins?: string[];
        hosts?: string[];
    }): void;
    /** Mint a replacement for an operator-triggered reauthentication ceremony. */
    mintBootstrap(): string;
    validateBoundary(request: FastifyRequest, requireOrigin: boolean): void;
    exchange(request: FastifyRequest): AuthResult;
    login(request: FastifyRequest, password: string): AuthResult;
    anonymous(request: FastifyRequest): BrowserSession;
    resume(request: FastifyRequest): AuthResult;
    authenticate(request: FastifyRequest, mutation?: boolean): BrowserSession;
    logout(request: FastifyRequest): void;
    mintTicket(request: FastifyRequest, purpose: Ticket['purpose'], roleId?: string): {
        ticket: string;
        expiresAt: string;
    };
    consumeTicket(request: FastifyRequest, value: string, purpose: Ticket['purpose'], roleId?: string): BrowserSession;
    bindSocket(sessionId: string, socket: WebSocket): void;
    clearSessions(): void;
    revokeAllTrustedDevices(): number;
    shutdown(): void;
    private createSession;
    private removeSession;
    private consumeRate;
}
export declare function parseCookies(cookie: string): Record<string, string>;
export {};