import { ClassValue } from 'clsx';

declare function cn(...inputs: ClassValue[]): string;

declare function formatTokens(n: number): string;

/**
 * Validate a redirect URL to prevent open redirect attacks.
 * Returns the URL if it's a relative path or matches the allowed origin.
 * Returns '/' for any external or invalid URL.
 */
declare function validateRedirectUrl(url: string, allowedOrigin: string): string;

/**
 * Returns a safe href value for an anchor or image source.
 *
 * Allows: relative paths (starting with /, ./, ../), and absolute http(s) URLs.
 * Blocks: javascript:, data:, file:, vbscript:, mailto:, etc.
 *
 * React only sanitizes `javascript:` in href attributes by default; this
 * helper closes the gap for `data:` (which can carry HTML/JS) and any other
 * non-network protocol that a misconfigured or malicious config could supply.
 *
 * Returns the supplied `fallback` (default '#') for any input that fails
 * validation, so the markup never renders an unsafe URL.
 */
declare function safeUrl(url: string | undefined | null, fallback?: string): string;

/**
 * Client-side JWT payload decode — NO VERIFICATION.
 * For display purposes only. Never trust the result for auth decisions.
 */
declare function decodeJwtPayloadClient(jwt: string): Record<string, unknown> | null;
/**
 * Read the public session cookie (stackauth_session).
 * Returns parsed session data or null.
 */
declare function readSessionCookie(): {
    userId: string;
    expiresAt: number;
    planId?: string;
    address?: string;
    chain?: string;
    authMethod?: string;
} | null;
/**
 * Read the CSRF token cookie.
 */
declare function readCSRFCookie(cookieName?: string): string | null;

export { cn, decodeJwtPayloadClient, formatTokens, readCSRFCookie, readSessionCookie, safeUrl, validateRedirectUrl };