/**
 * @spfn/auth - Client Session Management
 *
 * Uses Jose JWE (JSON Web Encryption) to securely store session data in cookies
 * More efficient than Iron Session with better Edge Runtime support
 */
interface SessionData {
    userId: string;
    privateKey: string;
    keyId: string;
    algorithm: 'ES256' | 'RS256';
}
/**
 * Seal session data into encrypted JWT (JWE)
 *
 * @param data - Session data to encrypt
 * @param ttl - Time to live in seconds (default: 7 days)
 * @returns Encrypted JWT string
 */
declare function sealSession(data: SessionData, ttl?: number): Promise<string>;
/**
 * Unseal encrypted JWT (JWE) to session data
 *
 * @param jwt - Encrypted JWT string
 * @returns Session data
 * @throws Error if session is invalid or expired
 */
declare function unsealSession(jwt: string): Promise<SessionData>;
/**
 * Get session metadata without decrypting
 *
 * @param jwt - Encrypted JWT string
 * @returns Session metadata or null if invalid
 */
declare function getSessionInfo(jwt: string): Promise<{
    issuedAt: Date;
    expiresAt: Date;
    issuer: string;
    audience: string;
} | null>;
/**
 * Check if session is about to expire (within threshold)
 *
 * @param jwt - Encrypted JWT string
 * @param thresholdHours - Hours before expiry to trigger refresh (default: 24)
 * @returns True if session should be refreshed
 */
declare function shouldRefreshSession(jwt: string, thresholdHours?: number): Promise<boolean>;
/**
 * Validate session secret strength
 * Call this at startup to ensure proper configuration
 *
 * Validation criteria:
 * - Minimum 32 characters (256-bit)
 * - Minimum 16 unique characters
 * - Minimum 3.5 bits/char Shannon entropy (good randomness)
 */
declare function validateSessionSecret(): {
    valid: boolean;
    error?: string;
    details?: {
        length: number;
        uniqueChars: number;
        entropy: number;
    };
};

export { type SessionData, getSessionInfo, sealSession, shouldRefreshSession, unsealSession, validateSessionSecret };
