/**
 * The one name the auth cookie has.
 *
 * There used to be two. `authCookie()` wrote `stacks_auth` (via
 * `config.auth.cookie.name`, a key that did not exist on `AuthOptions`, so no
 * app using `satisfies AuthConfig` could even set it), while the Auth
 * middleware, `team.ts` and the stx page gate all read
 * `config.auth.defaultTokenName` — `auth-token`. A cookie the framework wrote
 * was never one the framework read, which is why apps ended up hand-writing a
 * token pack into `localStorage` from an inline script instead
 * (stacksjs/stacks#2236).
 *
 * Resolution order:
 *   1. an explicit `options.name`
 *   2. `config.auth.cookie.name` — the supported key
 *   3. `config.auth.defaultTokenName` — DEPRECATED, honoured so an app that
 *      had renamed it (and thereby renamed the cookie those readers wanted)
 *      keeps working. Ignored with a warning when it is not a legal cookie
 *      name, which it very often is not: it is a human-readable token label
 *      like `Web Session`.
 *   4. `auth-token`
 */
export declare function authCookieName(options?: AuthCookieOptions): string;
/**
 * Whether the auth cookie should carry `Secure`, decided from what the app
 * demonstrably is rather than what its environment is called.
 *
 * The old rule was "Secure unless APP_ENV looks development-ish", and it
 * failed open: `.env.example` ships `APP_ENV=development`, so an HTTPS
 * deployment that never changed the env name served its session token
 * without `Secure` (stacksjs/stacks#2275). Now the URL decides:
 *
 * - an `https://` app URL is always Secure
 * - a plain-HTTP or scheme-less URL drops Secure only on a loopback host
 *   (localhost, `*.localhost`, 127.0.0.1) — the one place plain HTTP is a
 *   development reality rather than a misconfiguration
 * - with no URL configured at all, only the unambiguous `local` / `dev`
 *   environment names opt out; `development` no longer does
 *
 * Exported for tests; `authCookie()` feeds it the live config.
 */
export declare function shouldSecureAuthCookie(app?: { url?: unknown, env?: unknown }): boolean;
/**
 * The `Set-Cookie` value that signs a browser in.
 *
 * Pair it with the token from `Auth.login()`:
 *
 * ```ts
 * const result = await Auth.login({ email, password })
 * return new Response(null, {
 *   status: 303,
 *   headers: { 'Location': '/account', 'Set-Cookie': authCookie(result.token) },
 * })
 * ```
 */
export declare function authCookie(token: string, options?: AuthCookieOptions): string;
/**
 * The `Set-Cookie` value that signs a browser out.
 *
 * Every attribute except the value has to match the cookie being replaced, or
 * the browser keeps the original alongside the expired one.
 */
export declare function clearAuthCookie(options?: AuthCookieOptions): string;
/** The raw token in a request's auth cookie, if it carries one. */
export declare function authCookieToken(request: Request | { headers: Headers }, options?: AuthCookieOptions): string | undefined;
/**
 * Auth cookie values: naming, attributes, and parsing.
 *
 * Split out of `cookie-auth.ts` so `authentication.ts` can read the cookie
 * without importing it back. Nothing here touches `Auth`, which is what makes
 * that safe; the parts that resolve a token to a user stay in `cookie-auth.ts`.
 *
 * The prose explaining WHY the cookie exists, and why it is httpOnly +
 * SameSite=Lax + conditionally Secure, lives on the re-export in
 * `cookie-auth.ts`.
 */
export declare interface AuthCookieOptions {
  name?: string
  maxAge?: number
  path?: string
  domain?: string
  secure?: boolean
  sameSite?: 'Strict' | 'Lax' | 'None'
}