import type { Plugin } from './app';
import { type CookieOptions } from './cookies';
/** Data bag persisted for one session; values must be JSON-serializable once a non-memory {@link SessionStore} (e.g. Redis) round-trips them. */
export type SessionData = Record<string, unknown>;
/**
 * Pluggable session backend. Async so a real store (Redis, a database) can back
 * it; {@link memorySessionStore} is the in-process default.
 */
export interface SessionStore {
    /**
     * Load a session's data, or `undefined` if absent/expired.
     *
     * @param id - The session id to load.
     * @returns The session's data, or `undefined` if absent or expired.
     */
    get(id: string): Promise<SessionData | undefined>;
    /**
     * Persist a session's data. The {@link session} plugin calls this at request
     * end only when the session is dirty, so a TTL-based store should refresh the
     * entry's expiry here (lifetime slides on write, not on read).
     *
     * @param id - The session id to store under.
     * @param data - The full data bag to persist, replacing any prior value for `id`.
     */
    set(id: string, data: SessionData): Promise<void>;
    /**
     * Remove a session. Called on {@link Session.destroy} (logout) and, after
     * {@link Session.regenerate}, on the superseded old id. Should be idempotent.
     *
     * @param id - The session id to remove.
     */
    destroy(id: string): Promise<void>;
}
/**
 * In-memory {@link SessionStore} backed by a `Map`. Fine for a single process or
 * tests; use a shared store (Redis, a database) across replicas.
 *
 * @param options - `ttl` is the lifetime in **seconds** (stored internally as
 *   ms); it is refreshed on every write, so idle read-only requests do not
 *   extend it. Omit `ttl` for sessions that never expire. Expired entries are
 *   purged lazily on the next {@link SessionStore.get}, not on a timer.
 */
export declare function memorySessionStore(options?: {
    ttl?: number;
}): SessionStore;
/** Options for {@link session}. */
export interface SessionOptions {
    /** Backing store (default {@link memorySessionStore}). */
    store?: SessionStore;
    /** Session-id cookie name (default `"sid"`). */
    cookie?: string;
    /**
     * Cookie attributes. Defaults to `HttpOnly`, `SameSite=Lax`, `Path=/`. Add
     * `secure: true` in production (HTTPS).
     */
    cookieOptions?: CookieOptions;
}
/**
 * Request-scoped session accessor. A singleton, but every method reads the
 * *current* request's session from `AsyncLocalStorage`, so injecting it into a
 * singleton controller still yields per-request data. Requires the
 * {@link session} plugin to be installed.
 *
 * ```ts
 * class Auth {
 *   private readonly session = inject(Session)
 *   @post('/login') login() { this.session.set('userId', '42') }   // mints a session
 *   @post('/logout') logout() { this.session.destroy() }           // clears it
 * }
 * ```
 */
export declare class Session {
    private current;
    /** The session id, or `undefined` before anything is stored. */
    get id(): string | undefined;
    /** The whole data bag (mutating it directly does not mark the session dirty). */
    get data(): SessionData;
    /**
     * Read a stored value by key. `T` is an **unchecked cast** — the value is not
     * validated at runtime — so narrow or validate untrusted session data yourself.
     *
     * @typeParam T - Asserted type of the stored value (cast, not verified).
     * @param key - The key to read from the session data.
     * @returns The stored value, or `undefined` if the key is unset.
     */
    get<T = unknown>(key: string): T | undefined;
    /**
     * Store a value. The first write mints a session id and flags the session
     * dirty, so the {@link session} plugin persists it and sends the cookie at
     * request end; it also cancels a {@link destroy} made earlier in the request.
     *
     * @param key - The key to store the value under.
     * @param value - The value to store.
     */
    set(key: string, value: unknown): void;
    /**
     * Remove a single value and flag the session dirty. Removes only this key, not
     * the session; unlike {@link set} it never mints an id, so deleting on a
     * session that was never written persists nothing.
     *
     * @param key - The key to remove from the session data.
     */
    delete(key: string): void;
    /** Drop all values but keep the session (and its id). */
    clear(): void;
    /**
     * Issue a fresh id while keeping the data — call right after authenticating to
     * defend against session fixation. The old id is destroyed on persist.
     */
    regenerate(): void;
    /** Destroy the session and expire its cookie (log the user out). */
    destroy(): void;
}
/**
 * Plugin: cookie-based sessions backed by a {@link SessionStore}. Loads the
 * session named by the id cookie before the handler runs, exposes it through the
 * injectable {@link Session}, and persists changes afterwards — setting the
 * cookie when a session is first written, and expiring it on
 * {@link Session.destroy}. Sessions are created lazily, so an anonymous request
 * that never writes gets no cookie and no store entry.
 *
 * ```ts
 * const app = await createApp({ plugins: [session()] })
 * ```
 *
 * @param options - Store, cookie name, and cookie attribute overrides.
 * @returns A plugin that loads, exposes, and persists the per-request session.
 */
export declare function session(options?: SessionOptions): Plugin;
//# sourceMappingURL=session.d.ts.map