import type { ActorResolver } from './spi/actor-resolver.js';
import type { Actor } from './types.js';
/** Options for {@link AnonymousActorResolver}. All optional. */
export interface AnonymousActorOptions {
    /** Cookie name. Default `agent_anon`. */
    cookieName?: string;
    /** Cookie lifetime in days. Default 365. */
    maxAgeDays?: number;
    /** `SameSite`. Default `lax`; `none` (a cross-site client) forces `Secure`. */
    sameSite?: 'lax' | 'strict' | 'none';
    /** `Secure`. Default `'auto'` — set when the request came over HTTPS. */
    secure?: boolean | 'auto';
    /** Cookie path. Default `/`. */
    path?: string;
    /** Roles every anonymous actor holds. Default `['anonymous']`. */
    roles?: string[];
}
/**
 * The default identity when `config/agent.ts` sets no `actorResolver`: the endpoints are PUBLIC and
 * every browser is its own anonymous actor, so visitors never share threads, quota or attachments.
 *
 * On the first request without it, the response sets `agent_anon=<32 random bytes, base64url>;
 * Path=/; Max-Age=31536000; HttpOnly; SameSite=Lax` (plus `Secure` over HTTPS), and the actor id is
 * `anon:` + a SHA-256 digest of the token — the contract of `@dudousxd/nestjs-agent`'s resolver of
 * the same name. The cookie is `HttpOnly` (page scripts cannot read it), server-minted, and needs no
 * secret: the digest is stable across pods and restarts. A client needs no code for it.
 *
 * Require login instead with `actorResolver: new AuthActorResolver()` (reads `ctx.auth.user`).
 */
export declare class AnonymousActorResolver implements ActorResolver {
    private readonly options;
    private readonly cookieName;
    private readonly roles;
    constructor(options?: AnonymousActorOptions);
    resolve(context: unknown): Actor;
    private setCookie;
}
//# sourceMappingURL=anonymous-actor-resolver.d.ts.map