/**
 * Bobbit session cookie auth.
 *
 * Issued on successful Bearer-token authentication so subsequent UI traffic
 * (and especially `/preview/<sid>/*` content origin requests, which can't
 * carry an Authorization header from an iframe `src=`) authenticate via a
 * standard browser cookie.
 *
 * Cookie value is an opaque 32-byte hex string; the bearer token itself is
 * never embedded. Values are stored at `<stateDir>/auth-cookies.json` so
 * they survive gateway restarts. Sandbox tokens DO NOT mint cookies — they
 * keep their scoped allow-list flow.
 */
import type http from "node:http";
export declare const COOKIE_NAME = "bobbit_session";
export declare class CookieStore {
    private filePath;
    private data;
    private loaded;
    private writeTimer;
    constructor(stateDir: string);
    private ensureLoaded;
    private scheduleWrite;
    private flush;
    /** True if `value` is a known issued cookie. */
    verify(value: string): boolean;
    /** Mint a new cookie value, persist it, return the value. */
    mint(): string;
    /** Revoke a cookie value. */
    revoke(value: string): void;
    /** Test-only: synchronously flush pending writes. */
    flushNow(): void;
}
/** Parse the `Cookie` request header into a flat record. */
export declare function parseCookies(req: http.IncomingMessage): Record<string, string>;
/**
 * Module-level helper: returns true if the request carries a valid bobbit
 * session cookie known to `store`.
 */
export declare function tryAuth(req: http.IncomingMessage, store: CookieStore): boolean;
/**
 * Mint and Set-Cookie if no valid cookie is already present.
 *
 * `localhost` controls the `Secure` flag — localhost mode (HTTP) cannot use
 * `Secure` because the browser would discard the cookie.
 */
export declare function issueIfMissing(req: http.IncomingMessage, res: http.ServerResponse, store: CookieStore, opts?: {
    localhost?: boolean;
}): void;
/** Helper: extract cookie value from req, useful for SSE re-auth. */
export declare function extractCookieValue(req: http.IncomingMessage): string | undefined;
//# sourceMappingURL=cookie.d.ts.map