import type { Cookies } from '@sveltejs/kit';
import type { AuthConfig, AuthLogger, AuthSession, JwtConfig } from '../types.js';
import type { FullAuthUser, RefreshTokenRepository } from './adapters/types.js';
import { type RotateOutcome, type SessionMeta } from './refresh-token.js';
/**
 * Build the per-session metadata (user-agent + optional IP) from a request
 * event. The IP is captured only when the consumer opts in via
 * `config.sessions.storeIp` (it's personal data). Pass the result to
 * {@link establishSession} so login/register/passkey sessions appear in the
 * session list with a recognisable device.
 */
export declare function resolveSessionMeta(event: {
    request: Request;
    getClientAddress: () => string;
}, config: {
    sessions?: {
        storeIp?: boolean;
    };
}): SessionMeta;
export declare function setSessionCookie<R extends string>(cookies: Cookies, payload: AuthSession<R>, config: JwtConfig): Promise<void>;
/**
 * Delete the session cookie, mirroring {@link setSessionCookie}'s Path AND
 * Domain attributes. The symmetry is load-bearing: a delete whose Domain does
 * not match the set targets a *different* cookie as far as the browser is
 * concerned, and the session would survive logout.
 */
export declare function clearSessionCookie(cookies: Cookies, config: JwtConfig): void;
export declare function getSessionFromCookie<R extends string>(cookies: Cookies, config: JwtConfig, logger?: AuthLogger): Promise<AuthSession<R> | null>;
/**
 * Build the JWT session payload from a user row. One copy on purpose — this
 * literal existed five times (handle hook ×2, refresh handler ×2, here): a
 * field drifting in one copy (say, a forgotten `tokenVersion`) would mint
 * sessions that bypass the "log out everywhere" revocation check.
 */
export declare function sessionPayload<R extends string>(user: Pick<FullAuthUser<R>, 'id' | 'email' | 'role' | 'tokenVersion'>): AuthSession<R>;
/**
 * Apply a refresh-rotation outcome to the response cookies — the single
 * policy shared by the transparent handle-hook path and the explicit refresh
 * endpoint (previously two full copies):
 *
 * - `'rotated'` — fresh access token AND the successor refresh cookie.
 * - `'race_ok'` — concurrent-rotation loser: fresh access token only. The
 *   winner's response is already writing the successor refresh cookie to the
 *   same browser jar; touching it here would clobber the winner's value.
 * - anything else (`reused`/`expired`/`not_found`/`revoked`) — drop both
 *   cookies.
 *
 * Returns the authenticated user (for `locals` / the response body), or
 * `null` when the outcome ended the session.
 */
export declare function applyRotationOutcome<R extends string>(cookies: Cookies, outcome: RotateOutcome<R>, config: AuthConfig<R>): Promise<FullAuthUser<R> | null>;
/**
 * Issue the full client-side session state after authentication: sets the
 * access-token cookie and — when refresh-token rotation is configured —
 * additionally issues and persists a fresh refresh token. Handlers should
 * prefer this over calling `setSessionCookie` directly so the refresh
 * semantics stay in one place.
 */
export declare function establishSession<R extends string>(cookies: Cookies, user: FullAuthUser<R>, config: AuthConfig<R>, repos: {
    refreshToken?: RefreshTokenRepository;
}, meta?: SessionMeta): Promise<void>;
/**
 * Tear down the full session: clears the access-token cookie and, when
 * refresh-token rotation is configured, additionally clears the refresh
 * cookie. Callers are responsible for revoking the matching `RefreshToken`
 * row if they want to invalidate server-side — see
 * `revokeRefreshFromCookie` for that.
 */
export declare function endSession<R extends string>(cookies: Cookies, config: AuthConfig<R>): void;