/**
 * Server-only binding between a browser and its eve session.
 *
 * The chat route talks to the eve agent with the site's own credentials, so
 * it must only ever contact a session this browser created through the
 * route. The session ID lives in an HMAC-signed, httpOnly cookie that page
 * scripts cannot read; the browser only stores a non-reversible tag of the
 * session in message metadata so the route can tell which conversation a
 * session belongs to.
 *
 * Cookie value: `base64url(JSON payload) + "." + base64url(HMAC-SHA256)`.
 * The MAC covers a versioned domain-separation prefix, the agent URL (kept
 * out of the payload so the browser never sees it), and the encoded payload.
 */
export declare const CHAT_SECRET_ENV = "GEISTDOCS_CHAT_SECRET";
export declare const MIN_CHAT_SECRET_BYTES = 32;
export declare const EVE_AGENT_SESSION_COOKIE = "geistdocs_eve_session";
export declare const EVE_AGENT_SESSION_MAX_AGE_SECONDS: number;
export interface EveAgentCookieSession {
    /** Created by a prewarm request and not yet used for a turn. */
    prewarmed: boolean;
    sessionId: string;
}
export interface EveAgentSessionCookieCodec {
    /**
     * Return the session a cookie value carries, or `null` for anything that
     * is not a valid, unexpired cookie issued for this agent with this secret.
     */
    open: (value: string) => EveAgentCookieSession | null;
    /** Seal a session into a cookie value with a fresh expiry. */
    seal: (session: EveAgentCookieSession) => string;
    /**
     * Short, non-reversible tag for a session ID. Stored in assistant message
     * metadata so the route can match a conversation to the cookie's session
     * without exposing the session ID to page scripts.
     */
    tag: (sessionId: string) => string;
}
/**
 * Validate a chat secret. Throws for secrets too short to resist guessing
 * so a misconfigured deployment fails loudly instead of signing cookies
 * with a weak key. A base64 value that decodes to 32 bytes (44 characters)
 * passes, because the raw string is used as the key.
 */
export declare const assertChatSecret: (secret: string) => void;
export declare const createEveAgentSessionCookieCodec: ({ agentUrl, now, secret, ttlMs, }: {
    /** Normalized agent URL the sessions belong to. */
    agentUrl: string;
    /** Clock override for tests. */
    now?: () => number;
    secret: string;
    ttlMs?: number;
}) => EveAgentSessionCookieCodec;
/** Compare two session tags without leaking where they differ. */
export declare const isSameSessionTag: (actual: string, expected: string) => boolean;
/**
 * Every value sent for `name` in a `Cookie` header, in header order.
 * Browsers send one value per matching path, most specific first, so
 * callers should try each value rather than trusting the first.
 */
export declare const readCookieValues: (header: string | null, name: string) => string[];
/**
 * `Set-Cookie` header for the eve session. The cookie is scoped to the
 * chat route's own path, so it follows any endpoint or base path without
 * configuration, and is never sent with page or asset requests.
 */
export declare const serializeEveAgentSessionCookie: (value: string, req: Request) => string;
//# sourceMappingURL=eve-agent-session-cookie.d.ts.map