import { P as PostMessageClient } from '../types-CXDDCs0b.js';

interface HandoffUser {
    uuid: string;
    name: string;
    email: string;
}
interface HandoffSuccess {
    ok: true;
    user: HandoffUser;
    sessionToken: string;
    shareId: string;
    nextPath: string;
}
type HandoffFailureReason = 'expired' | 'consumed' | 'wrong_target' | 'unknown' | 'network';
interface HandoffFailure {
    ok: false;
    reason: HandoffFailureReason;
    status?: number;
}
type HandoffResult = HandoffSuccess | HandoffFailure;
interface ConsumeHandoffTokenOptions {
    /** Opaque handoff token from `?token=` */
    token: string;
    /** Destination's own PHP backend base URL, e.g. `process.env.NEXT_PUBLIC_BACKEND_URL` */
    backendUrl: string;
    /** Destination's service API key (server-side env var) */
    serviceApiKey: string;
    /** Internal shared secret between this Next server and its PHP backend */
    internalToken: string;
    /** Override the default 5000ms abort timeout */
    timeoutMs?: number;
}

/**
 * Server-side handoff token redemption.
 *
 * Calls the destination's own PHP backend at `POST /api/v1/inbound/handoff/exchange`
 * (controller mounted by `auth-service-helper` in phase D2c). The backend relays
 * to auth-service `POST /handoff-tokens/{token}/exchange` with its X-API-KEY,
 * then returns the resolved user + session token to this Next layer.
 *
 * Never call auth-service directly from here — keep service API keys in PHP.
 */
declare function consumeHandoffToken(options: ConsumeHandoffTokenOptions): Promise<HandoffResult>;

interface CreateHandoffRouteHandlerOptions {
    /** Destination's own PHP backend base URL (server env var). */
    backendUrl: string;
    /** Destination's service API key (server env var). */
    serviceApiKey: string;
    /** Internal shared secret between this Next server and its PHP backend. */
    internalToken: string;
    /** Where to send users on missing/invalid tokens. Default: `/login`. */
    loginPath?: string;
    /** Landing page path that runs the client-side multi-account auto-add. Default: `/auth/handoff/landing`. */
    landingPath?: string;
}
/**
 * Build a Next App Router GET handler for `app/auth/handoff/route.ts`.
 *
 * Consumer usage (copy-pasta — package can't ship route files):
 *
 * ```ts
 * // src/app/auth/handoff/route.ts
 * import { createHandoffRouteHandler } from '@benbraide/auth-service-nextjs/sharing';
 *
 * export const GET = createHandoffRouteHandler({
 *   backendUrl: process.env.NEXT_PUBLIC_BACKEND_URL!,
 *   serviceApiKey: process.env.NEXT_SERVICE_API_KEY!,
 *   internalToken: process.env.NEXT_INTERNAL_TOKEN!,
 * });
 * ```
 */
declare function createHandoffRouteHandler(options: CreateHandoffRouteHandlerOptions): (request: Request) => Promise<Response>;

declare class MultiAccountAutoAddError extends Error {
    readonly reason: string;
    constructor(reason: string, message?: string);
}
interface SwitcherApi {
    addAccount: () => Promise<void>;
    switchAccount: (uuid: string) => Promise<void>;
}
interface MultiAccountAutoAddOptions {
    accountUuid: string;
    sessionToken: string;
    switcher: SwitcherApi;
    /** The live PostMessageClient (typically from AccountSwitcherProvider context). */
    client: Pick<PostMessageClient, 'on' | 'off'>;
    /**
     * Function that posts a typed message to the iframe. Defaults to the
     * private `sendMessage` of PostMessageClient — injected here for unit
     * testability since the real method is private.
     */
    sendMessage: (type: string, payload: unknown) => void;
    /** Override the default 5000ms ack timeout. */
    timeoutMs?: number;
}
/**
 * Push a pre-authenticated account into the destination's account switcher.
 *
 * 1. Sends ADD_ACCOUNT_WITH_TOKEN over postMessage
 * 2. Awaits ADD_ACCOUNT_WITH_TOKEN_OK / _FAILED (timeout-guarded)
 * 3. On OK, calls switcher.switchAccount(accountUuid)
 * 4. On FAILED or timeout, throws MultiAccountAutoAddError
 *
 * Used by HandoffLanding (F5). The iframe-side handler is the A6 work.
 */
declare function multiAccountAutoAdd(options: MultiAccountAutoAddOptions): Promise<void>;

export { type ConsumeHandoffTokenOptions, type CreateHandoffRouteHandlerOptions, type HandoffFailure, type HandoffFailureReason, type HandoffResult, type HandoffSuccess, type HandoffUser, MultiAccountAutoAddError, type MultiAccountAutoAddOptions, type SwitcherApi, consumeHandoffToken, createHandoffRouteHandler, multiAccountAutoAdd };