import { MaybePromise } from "@entwico/dash";
import { StringPattern } from "@entwico/dash/match";
import { ActionAPIContext, ActionClient, ActionError, ActionErrorCode } from "astro:actions";
import { z } from "astro/zod";
import { APIContext, APIRoute, MiddlewareHandler } from "astro";
//#region src/guards/guard.d.ts
/** what a guard proves about the request: merged into `locals` for the guarded code */
type Proof = Record<string, unknown>;
/** the request context every guard runs against — the part actions, endpoints and pages share */
type GuardContext = ActionAPIContext;
/** the page context: an endpoint's `context` or a page's `Astro`, which can also redirect and rewrite */
type PageContext = GuardContext & Pick<APIContext, 'redirect' | 'rewrite'>;
type GuardedLocals<Locals, P extends Proof> = Omit<Locals, keyof P> & P;
/** the context with the proofs of the guards made required on `locals` */
type GuardedContext<Ctx extends GuardContext, P extends Proof> = Omit<Ctx, 'locals'> & {
  locals: GuardedLocals<Ctx['locals'], P>;
};
type GuardInput<Shape extends z.ZodRawShape | undefined> = Shape extends z.ZodRawShape ? z.output<z.ZodObject<Shape>> : unknown;
type GuardPageDenial = (ctx: PageContext, denial: ActionError) => MaybePromise<Response>;
type GuardDefinition<R extends Proof | void, Shape extends z.ZodRawShape | undefined, Ctx extends GuardContext> = {
  name: string;
  /** request fields the guard needs: merged into the action's input schema, stripped again before the handler */
  input?: Shape | undefined;
  /** denies by throwing (see `deny`), proves by returning the values the guarded code may rely on */
  check: (ctx: Ctx, input: GuardInput<Shape>) => MaybePromise<R>;
  /**
   * what a browser sees when this guard denies (a redirect, a rewrite);
   * default: the denial's status with its message
   */
  page?: GuardPageDenial | undefined;
};
type ProofOf<R> = R extends Proof ? R : Record<never, never>;
type ShapeOf<Shape> = Shape extends z.ZodRawShape ? Shape : Record<never, never>;
interface Guard<P extends Proof = Record<never, never>, Shape extends z.ZodRawShape = Record<never, never>> {
  readonly name: string;
  /** the fields this guard and its parents need from the request */
  readonly input: Shape | undefined;
  readonly page: GuardPageDenial | undefined;
  /** @internal runs the parents, then the check; the proofs land on `ctx.locals` and are returned merged */
  run(ctx: GuardContext, input: unknown): Promise<P>;
  /** a guard that runs after this one, with this one's proofs already on `locals` */
  extend<R extends Proof | void, NextShape extends z.ZodRawShape | undefined = undefined>(definition: GuardDefinition<R, NextShape, GuardedContext<GuardContext, P>>): Guard<P & ProofOf<R>, Shape & ShapeOf<NextShape>>;
}
type ProofOfGuard<G> = G extends Guard<infer P, any> ? P : never;
type ShapeOfGuard<G> = G extends Guard<any, infer S> ? S : never;
type Intersected<T> = UnionToIntersection<T> extends (infer I) ? (I extends object ? I : Record<never, never>) : never;
/** proofs of a guard list, intersected */
type Proofs<Guards extends readonly Guard[]> = Intersected<ProofOfGuard<Guards[number]>>;
/** request fields of a guard list, intersected */
type GuardShapes<Guards extends readonly Guard[]> = Intersected<ShapeOfGuard<Guards[number]>>;
type UnionToIntersection<U> = (U extends unknown ? (x: U) => void : never) extends ((x: infer I) => void) ? I : never;
export declare function defineGuard<R extends Proof | void, Shape extends z.ZodRawShape | undefined = undefined>(definition: GuardDefinition<R, Shape, GuardContext>): Guard<ProofOf<R>, ShapeOf<Shape>>;
/** denies the request: an `ActionError` for actions, the matching status for endpoints and pages */
export declare function deny(code: ActionErrorCode, message?: string): never;
export declare function isDenial(error: unknown): error is ActionError;
//#endregion
//#region src/guards/actions.d.ts
type ActionAccept = 'form' | 'json';
type GuardedActionHandler<TInputSchema, TOutput, Guards extends readonly Guard[]> = TInputSchema extends z.core.$ZodType ? (input: z.output<TInputSchema>, context: GuardedContext<ActionAPIContext, Proofs<Guards>>) => MaybePromise<TOutput> : (input: any, context: GuardedContext<ActionAPIContext, Proofs<Guards>>) => MaybePromise<TOutput>;
/** the schema the client calls with: the action's own, plus the fields its guards read */
type ClientInputSchema<TInputSchema, Guards extends readonly Guard[]> = keyof GuardShapes<Guards> extends never ? TInputSchema : TInputSchema extends z.ZodObject<infer Shape> ? z.ZodObject<Shape & GuardShapes<Guards>> : TInputSchema extends undefined ? z.ZodObject<GuardShapes<Guards>> : TInputSchema;
type GuardedActionOptions<TOutput, TAccept extends ActionAccept | undefined, TInputSchema extends z.core.$ZodType | undefined, Guards extends readonly Guard[]> = {
  accept?: TAccept;
  input?: TInputSchema;
  /** run in order after validation; a denial becomes the action's error, the proofs land on `context.locals` */
  guards?: Guards;
  handler: GuardedActionHandler<TInputSchema, TOutput, Guards>;
};
/**
 * Astro's `defineAction` with guards: the listed guards run after input validation and before the
 * handler, which sees `locals` with their proofs required. Fields a guard declares in `input` are
 * merged into the action's schema and stripped again before the handler — the action never learns
 * about them.
 */
export declare function defineAction<TOutput, TAccept extends ActionAccept | undefined = undefined, TInputSchema extends z.core.$ZodType | undefined = TAccept extends 'form' ? z.core.$ZodType<FormData> : undefined, const Guards extends readonly Guard[] = []>(options: GuardedActionOptions<TOutput, TAccept, TInputSchema, Guards>): ActionClient<TOutput, TAccept, ClientInputSchema<TInputSchema, Guards>> & string;
//#endregion
//#region src/guards/routes.d.ts
type GuardedRouteOptions<Guards extends readonly Guard[]> = {
  /**
   * run in order before the handler; a denial answers per the request:
   * json for api callers, the page response for a browser
   */
  guards: Guards;
  handler: (context: GuardedContext<APIContext, Proofs<Guards>>) => Response | Promise<Response>;
};
/**
 * An endpoint behind guards. Fields the guards declare in `input` are read from the request body
 * (json or form data); the body stays readable for the handler.
 */
export declare function defineRoute<const Guards extends readonly Guard[]>(options: GuardedRouteOptions<Guards>): APIRoute;
//#endregion
//#region src/guards/denial.d.ts
/**
 * One denial policy for endpoints, pages and the middleware, decided by the request rather than
 * by the surface: a browser navigation — `text/html` in `Accept`, the same signal astro uses to
 * tell a form submission from an rpc call — gets the denying guard's `page` response (a redirect
 * to the login, a 404 rewrite), or the status with the message; anything else gets a json error
 * it can act on.
 */
export declare function denialResponse(context: PageContext, denial: ActionError): Promise<Response>;
export declare function acceptsHtml(request: Request): boolean;
//#endregion
//#region src/guards/pages.d.ts
type Guarded<P extends Proof> = ({
  denied: Response;
} & { [K in keyof P]?: undefined; }) | ({
  denied?: undefined;
} & P);
/**
 * Guards a page from its frontmatter: `const { denied, user } = await guard(Astro, [authenticated]);
 * if (denied) return denied;` — after the check the proofs are required, before it they are not.
 * The denial is the one the request asked for: the denying guard's `page` response for a browser,
 * a json error for anything else (see `denialResponse`).
 */
export declare function guard<const Guards extends readonly Guard[]>(context: PageContext, guards: Guards): Promise<Guarded<Proofs<Guards>>>;
//#endregion
//#region src/guards/middleware.d.ts
type GuardRule = {
  /** request paths the guards apply to, in the exclude-pattern vocabulary */
  match: readonly StringPattern[];
  guards: readonly Guard[];
};
/**
 * Guards whole areas from the middleware: every rule whose patterns match the request path runs
 * its guards, and the first denial answers per the request: the denying guard's `page` response
 * for a browser, a json error for an api caller. Defence in depth, not a replacement for the
 * page-level `guard()`: a middleware cannot narrow `locals`, and
 * guards that already passed here are not run again by the page's call.
 */
export declare function createGuardMiddleware(rules: readonly GuardRule[]): MiddlewareHandler;
//#endregion
//#region src/guards/rate-limit.d.ts
type RateLimitOptions = {
  /** requests allowed per key within the window */
  max: number;
  /** window length in milliseconds */
  window: number;
  /**
   * What the limit is counted against; defaults to the client address. Return `undefined` to
   * exempt a request.
   */
  key?: ((ctx: GuardContext) => string | undefined) | undefined;
  /** the guard's name in denials and logs; default `rate-limit` */
  name?: string | undefined;
};
/**
 * A fixed window per key, in memory and per process: the `max`-th request within `window` ms
 * still passes, the next one is denied with `TOO_MANY_REQUESTS` (429) until the window ends.
 * Per process means per pod; the total across replicas is still bounded, just by that factor.
 * Put it first in a guard list so a flood is refused before any guard that costs something
 * (a captcha verification, a database lookup) runs.
 */
export declare function rateLimit(options: RateLimitOptions): Guard;
//#endregion
export type { ClientInputSchema, Guard, GuardContext, GuardDefinition, GuardInput, GuardPageDenial, GuardRule, GuardShapes, Guarded, GuardedActionHandler, GuardedActionOptions, GuardedContext, GuardedLocals, GuardedRouteOptions, PageContext, Proof, Proofs, RateLimitOptions };
//# sourceMappingURL=guards.d.ts.map