export { parseCookie } from '@rudderjs/support';
export interface RememberCookieAttrs {
    /** Cookie name. */
    cookie: string;
    /** Cookie lifetime in days. */
    lifetime: number;
    secure: boolean;
    sameSite: 'lax' | 'strict' | 'none';
    path: string;
}
export type RememberDirective = {
    action: 'set';
    userId: string;
    token: string;
} | {
    action: 'clear';
};
/** Establish a request-scoped channel for the remember directive. */
export declare function runWithRemember<T>(fn: () => T): T;
/** Queue a remember directive from the guard (login/logout). No-op outside a
 *  request scope (CLI/queue) — there's no response cookie to write there. */
export declare function setRememberDirective(directive: RememberDirective): void;
/** Read and clear the queued directive (consumed by AuthMiddleware). */
export declare function takeRememberDirective(): RememberDirective | null;
/** A fresh 256-bit remember token (hex). */
export declare function newRememberToken(): string;
/** Constant-time string compare, length-safe. */
export declare function safeStringEqual(a: string, b: string): boolean;
/** Sign `userId:token` into a self-verifying cookie value. */
export declare function encodeRememberCookie(userId: string, token: string, secret: string): string;
/** Verify + parse a remember cookie. Returns null on any tampering. */
export declare function decodeRememberCookie(value: string, secret: string): {
    userId: string;
    token: string;
} | null;
/** Build the `Set-Cookie` value for a remember cookie (or its deletion). */
export declare function buildRememberCookie(value: string | null, attrs: RememberCookieAttrs): string;
/** Cookie attributes (name/lifetime/flags). Never throws — safe to call on
 *  every request to learn the cookie name without resolving the secret. */
export declare function rememberCookieAttrs(overrides?: Partial<RememberCookieAttrs>): RememberCookieAttrs;
/** Resolve the HMAC secret used to sign remember cookies. Mirrors the
 *  PasswordBroker posture: throws in production when `AUTH_SECRET` is unset,
 *  falls back to a dev placeholder (with a one-time notice) otherwise. Only
 *  called when a remember cookie is actually being signed or verified, so an
 *  app that never uses remember-me is never forced to set the secret. */
export declare function resolveRememberSecret(override?: string): string;
//# sourceMappingURL=remember.d.ts.map