export interface SessionPayload {
    userId: string;
    role: string;
    sessionId: string;
    fingerprint?: string;
}
/**
 * Thrown when a JWT verifies cryptographically but its decoded payload
 * doesn't match the expected `SessionPayload` shape. We map this to a 401
 * (not 500) because it represents a forged-but-correctly-signed-by-the-CMS
 * token rather than a server bug.
 */
export declare class InvalidSessionPayloadError extends Error {
    constructor(reason: string);
}
export interface SessionOptions {
    secret: string;
    maxAge?: number;
    issuer?: string;
    audience?: string;
}
/** Create a signed JWT session token. */
export declare function createSession(payload: SessionPayload, options: SessionOptions): Promise<string>;
/** Verify and decode a JWT session token. */
export declare function verifySession(token: string, options: SessionOptions): Promise<SessionPayload>;
/** Revoke a session by marking it in the database. */
export declare function revokeSession(sessionId: string, db: any): Promise<void>;
/**
 * Refresh a session token, issuing a new JWT with an extended expiry.
 *
 * When `db` is supplied, the existing `Session` row is verified to be active
 * and its `expiresAt` is extended in lockstep with the new JWT. Without that
 * check, a revoked session that was still in a user's cookie could be
 * "un-revoked" simply by refreshing it.
 */
export declare function refreshSession(token: string, options: SessionOptions, db?: any): Promise<string>;
//# sourceMappingURL=session.d.ts.map