import type { Kysely } from 'kysely';
import type { Database, User } from '../db/schema.js';
export declare const SESSION_COOKIE_NAME = "taproot_session";
export interface SessionValidation {
    user: User;
    sessionId: string;
    /** True when the caller should re-issue the cookie because the expiry was extended. */
    refreshed: boolean;
    expiresAt: Date;
}
/** Generate a new session token. 32 bytes of CSPRNG output, hex-encoded. */
export declare function generateSessionToken(): string;
/** Derive the storage key for a token. Never store the token itself. */
export declare function hashSessionToken(token: string): Promise<string>;
export declare function createSession(db: Kysely<Database>, userId: string): Promise<{
    token: string;
    expiresAt: Date;
}>;
/**
 * Validate a session token and return the user behind it.
 *
 * Expired sessions are deleted as they are encountered, which keeps the table tidy without
 * needing a scheduled cleanup job for the common case.
 */
export declare function validateSession(db: Kysely<Database>, token: string): Promise<SessionValidation | null>;
export declare function invalidateSession(db: Kysely<Database>, token: string): Promise<void>;
/** Drop every session for a user — used on password change and on deactivation. */
export declare function invalidateUserSessions(db: Kysely<Database>, userId: string): Promise<void>;
/**
 * Drop every session for a user except the one presented.
 *
 * What "sign out everywhere" should mean when you are signing *yourself* out: the point is the
 * laptop left on a train, not the browser you are currently holding. Signing yourself out along
 * with it turns a precautionary action into an interruption, and people who get logged out for
 * doing the safe thing stop doing the safe thing.
 *
 * An admin doing this to someone else passes no token, which drops all of them — correct, because
 * none of those sessions is theirs to keep.
 */
export declare function invalidateOtherSessions(db: Kysely<Database>, userId: string, keepToken?: string): Promise<number>;
/** How many sessions a user currently has, so an admin can see what they are looking at. */
export declare function countUserSessions(db: Kysely<Database>, userId: string): Promise<number>;
/** Delete sessions that have already expired. Safe to call on a schedule. */
export declare function purgeExpiredSessions(db: Kysely<Database>): Promise<number>;
export interface SessionCookieOptions {
    /** Omit `Secure` in local HTTP development, where the browser would otherwise drop the cookie. */
    secure: boolean;
    path?: string;
}
export declare function buildSessionCookie(token: string, expiresAt: Date, options: SessionCookieOptions): string;
export declare function buildSessionClearCookie(options: SessionCookieOptions): string;