export declare const SESSION_COOKIE = "ts_cloud_session";
/** Project-relative location of the session signing secret. */
export declare function secretFile(): string;
/** Eight hours: long enough to work through a deploy, short enough to expire. */
export declare const SESSION_TTL_MS: number;
export interface SessionPayload {
    /** Username the session belongs to. */
    u: string;
    /** Expiry, epoch milliseconds. */
    exp: number;
    /** Organization membership versions at issuance; changes revoke the session. */
    mv?: Record<string, number>;
}
/**
 * Resolve the HMAC signing secret, generating and persisting one on first use.
 * The file is written 0600 — it is equivalent to every dashboard credential.
 */
export declare function resolveSessionSecret(cwd: string): string;
/** Issue a signed session token for `username`. */
export declare function createSessionToken(username: string, secret: string, ttlMs?: number, membershipVersions?: Record<string, number>): string;
/**
 * Verify a token and return its payload, or null when the signature is invalid,
 * the token is malformed, or it has expired. Signature is compared before the
 * payload is trusted for anything.
 */
export declare function verifySessionToken(token: string | undefined, secret: string): SessionPayload | null;
/** Read one cookie from a request's `Cookie` header. */
export declare function readCookie(header: string | null, name: string): string | undefined;
/**
 * Serialize the session cookie. `HttpOnly` keeps it away from page scripts,
 * `SameSite=Lax` blocks cross-site POSTs from carrying it (the dashboard's CSRF
 * defense), and `Secure` is set whenever the dashboard is not on loopback —
 * in production it is always behind TLS.
 */
export declare function serializeSessionCookie(token: string, options?: {
    secure: boolean;
    maxAgeMs?: number;
}): string;
/** Cookie that clears the session (logout). */
export declare function clearSessionCookie(options?: {
    secure: boolean;
}): string;
