import { KeyedSecret } from '@voltro/protocol/session';
import { SessionSecrets } from '@voltro/protocol/session';
import { Subject } from '@voltro/protocol';
import { SubjectIdentity } from '@voltro/protocol';
import { VerifyOptions } from '@voltro/protocol/session';
import { VerifyResult } from '@voltro/protocol/session';

/**
 * Build a `Set-Cookie` value that clears the session cookie. Send
 * this on logout.
 */
export declare const clearSessionCookie: (options?: IssueSessionOptions) => string;

export declare interface IssuedSession {
    /** The opaque cookie value — `<payload>.<sig>`. */
    readonly value: string;
    /** Ready-to-Set-Cookie header string with sane defaults. */
    readonly setCookie: string;
}

/**
 * Mint a signed session AND build the corresponding `Set-Cookie`
 * header in one call. Apps just attach the header to their
 * response. Pass a `SessionSecrets` set to sign with the current
 * rotation key (its `kid` is stamped into the payload).
 *
 * The subject is a `Subject | SubjectIdentity` at the type level and an
 * IDENTITY on the wire: a session cookie carries no `scopes`, and
 * `signSession` throws rather than dropping them silently. Authority for
 * this session is resolved per request by `auth.resolveScopes`, so a role
 * removed after sign-in takes effect on this same session.
 */
export declare const issueSession: (subject: Subject | SubjectIdentity, secret: SessionSecretInput, options?: IssueSessionOptions) => IssuedSession;

export declare interface IssueSessionOptions {
    readonly ttlSeconds?: number;
    readonly domain?: string;
    readonly secure?: boolean;
}

export { KeyedSecret }

/**
 * Read + verify the session cookie from a Cookie header string.
 * Returns the decoded IDENTITY (a Subject with no `scopes` — authority is
 * resolved per request, never carried in the cookie) or null when the cookie
 * is missing, malformed, tampered, expired, or minted under a superseded
 * payload version. Never throws — callers branch on the boolean.
 *
 * Verification is keyed: the given secret is widened via
 * `sessionSecretsOf`, so a cookie signed with the previous rotation
 * key keeps verifying while `VOLTRO_SESSION_SECRET_PREVIOUS` is set.
 */
export declare const readSession: (cookieHeader: string | undefined, secret: SessionSecretInput) => SubjectIdentity | null;

/**
 * Keyed read: the full `VerifyResult` — subject + the `kid` that
 * verified + the sliding-window `renew` flag + `exp`/`iat`. The auth
 * routes plugin re-issues the cookie when `renew` is set or when the
 * value verified under the previous key.
 */
export declare const readSessionKeyed: (cookieHeader: string | undefined, secret: SessionSecretInput, options?: VerifyOptions) => VerifyResult | null;

export declare const resolveSessionSecret: () => string;

export declare const resolveSessionSecrets: () => SessionSecrets;

export declare const SESSION_COOKIE_NAME: "voltro:session";

/** Every session helper takes either a bare secret string (single-key)
 *  or the keyed `{ current, previous? }` rotation set. */
export declare type SessionSecretInput = string | SessionSecrets;

export { SessionSecrets }

/**
 * Normalise a secret input into the keyed set VERIFICATION runs against.
 *
 *   - A `SessionSecrets` set passes through unchanged.
 *   - A bare string becomes `current` and is widened with the env-driven
 *     `previous` key (`VOLTRO_SESSION_SECRET_PREVIOUS` +
 *     `VOLTRO_SESSION_KID_PREVIOUS`) so env-var rotation works without
 *     the app switching its config to the keyed shape. When the string
 *     IS the env secret (`VOLTRO_SESSION_SECRET`), it inherits the env
 *     `kid`; otherwise the default kid applies. The comparison is
 *     constant-time — secrets never go through `===`.
 */
export declare const sessionSecretsOf: (secret: SessionSecretInput) => SessionSecrets;

export { VerifyResult }

export { }