import type { Authenticatable, Guard, UserProvider } from './contracts.js';
export interface SessionStore {
    get<T>(key: string, fallback?: T): T | undefined;
    put(key: string, value: unknown): void;
    forget(key: string): void;
    regenerate(): Promise<void>;
}
export declare class SessionGuard implements Guard {
    private readonly provider;
    private readonly session;
    private _user;
    constructor(provider: UserProvider, session: SessionStore);
    /**
     * Resolve the authenticated user, or `null` if none.
     *
     * **Soft-fails** when called outside an ALS-bound session context (api
     * route without session middleware, CLI/worker call, observer dispatched
     * out-of-band): returns `null` rather than throwing. Matches Laravel's
     * `Auth::user()` semantics — "unauthenticated" and "no session" both
     * collapse to the same null result, so api handlers can safely reference
     * `req.user` without crashing.
     *
     * Result is memoized per-guard-instance. The framework constructs a fresh
     * `SessionGuard` per request (no caching on `AuthManager`), so memoization
     * does not leak across requests.
     */
    user(): Promise<Authenticatable | null>;
    id(): Promise<string | null>;
    check(): Promise<boolean>;
    guest(): Promise<boolean>;
    attempt(credentials: Record<string, unknown>, remember?: boolean): Promise<boolean>;
    /**
     * Log a user in. When `remember` is true (and the provider supports
     * persistent tokens), mint a fresh remember token, persist it on the user,
     * and queue a long-lived remember cookie — `AuthMiddleware` writes it to the
     * response. The directive is a no-op outside an HTTP request scope.
     */
    login(user: Authenticatable, remember?: boolean): Promise<void>;
    /**
     * Resolve a user from a remember cookie's `userId`/`token` and, on a valid
     * constant-time token match, re-establish the session WITHOUT minting a new
     * token (the existing cookie stays valid — the token rotates only on a fresh
     * remember-login or logout). Returns whether auto-login succeeded. Used by
     * AuthMiddleware when there's no active session.
     */
    loginViaRememberCookie(userId: string, token: string): Promise<boolean>;
    logout(): Promise<void>;
    loginUsingId(id: string | number, remember?: boolean): Promise<boolean>;
    once(credentials: Record<string, unknown>): Promise<boolean>;
    onceUsingId(id: string | number): Promise<boolean>;
}
//# sourceMappingURL=session-guard.d.ts.map