import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, J as SocialIdTokenProvider, M as PersonalWorkspaceSelection, O as OrganizationTeamDisplay, Q as WorkspaceSelection, S as OrganizationMember, T as OrganizationPage, U as RemovedOrganizationMember, V as ReceivedOrganizationInvitationPage, W as ResentOrganizationInvitation, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, _ as InvitationAcceptance, b as OrganizationInvitation, c as AuthUser, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, h as DriveCredentialInput, j as OrganizationWorkspaceSelection, k as OrganizationTeamMemberPage, l as CanceledOrganizationInvitation, m as DriveCredential, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, t as AcceptInvitationInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, v as OrganizationDeparture, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay } from "./types-CrdIcEJ3.js";
//#region src/user-api/verifier.d.ts
interface UserApiIdentity {
  userId: string;
  sessionId: string;
  applicationId: string;
  issuedAt: Date;
  expiresAt: Date;
  user: AuthUser;
}
interface UserApiVerifierOptions {
  issuer: string;
  jwksUrl: string;
  audience: string;
  applicationId: string;
  environment: "local" | "development" | "staging" | "production";
  fetch?: typeof globalThis.fetch;
  now?: () => number;
}
/** One configured verifier can be shared. It retains public keys, never user authority. */
declare function createUserApiVerifier(options: UserApiVerifierOptions): {
  verify(token: string): Promise<UserApiIdentity>;
};
//#endregion
//#region src/identity-resolution.d.ts
interface IdentityResolverAuthOptions {
  authOrigin: string;
  fetch?: typeof globalThis.fetch;
  timeoutMs?: number;
}
interface ResolveIdentityInput {
  identifier: string;
}
interface ResolvedIdentity {
  userId: string;
}
interface FinuevaIdentityResolverAuth {
  resolveIdentity(input: ResolveIdentityInput, clientAssertion: string): Promise<ResolvedIdentity | null>;
}
/** Server-only identity resolution. Keep results private; they grant no product authority. */
declare function createIdentityResolverAuth(options: IdentityResolverAuthOptions): FinuevaIdentityResolverAuth;
//#endregion
//#region src/membership-resolution.d.ts
interface MembershipResolverAuthOptions {
  authOrigin: string;
  fetch?: typeof globalThis.fetch;
  timeoutMs?: number;
}
interface ResolveMembershipInput {
  organizationId: string;
  userId: string;
}
type ResolvedMembershipRole = "admin" | "member" | "owner";
interface ResolvedMembership {
  checkedAt: string;
  manualRole: ResolvedMembershipRole;
  memberCount: number;
  memberId: string;
  organizationId: string;
  owner: boolean;
  role: ResolvedMembershipRole;
  userId: string;
}
interface FinuevaMembershipResolverAuth {
  resolveMembership(input: ResolveMembershipInput, clientAssertion: string): Promise<ResolvedMembership | null>;
}
/** Server-only organization membership resolution. Keep results private; they are Auth authority, not product authority. */
declare function createMembershipResolverAuth(options: MembershipResolverAuthOptions): FinuevaMembershipResolverAuth;
//#endregion
//#region src/drive-recipients.d.ts
interface DriveRecipientAuthOptions {
  authOrigin: string;
  fetch?: typeof globalThis.fetch;
  timeoutMs?: number;
}
interface ResolveDriveRecipientInput {
  email: string;
}
interface DriveRecipient {
  userId: string;
  name: string;
  email: string;
}
interface FinuevaDriveRecipientAuth {
  resolveRecipient(input: ResolveDriveRecipientInput, clientAssertion: string): Promise<DriveRecipient>;
}
/** Service authority only. The caller signs assertions; Auth verifies their claims and signature. */
declare function createDriveRecipientAuth(options: DriveRecipientAuthOptions): FinuevaDriveRecipientAuth;
//#endregion
//#region src/provisioning.d.ts
interface DriveProvisioningAuthOptions {
  authOrigin: string;
  fetch?: typeof globalThis.fetch;
  now?: () => number;
  timeoutMs?: number;
}
interface DriveProvisioningCredential {
  tokenType: "Bearer";
  token: string;
  expiresAt: Date;
}
interface FinuevaDriveProvisioningAuth {
  getDriveProvisioningCredential(clientAssertion: string): Promise<DriveProvisioningCredential>;
}
/** Service authority only. Never pass an incoming User request or session to this client. */
declare function createDriveProvisioningAuth(options: DriveProvisioningAuthOptions): FinuevaDriveProvisioningAuth;
//#endregion
//#region src/server.d.ts
interface ServerAuthOptions {
  authOrigin: string;
  appOrigin: string;
  request: Request;
  fetch?: typeof globalThis.fetch;
  now?: () => number;
  timeoutMs?: number;
}
interface ServerSignOutResult {
  applyCookies(headers: Headers): void;
}
interface ServerInvitationAcceptance extends InvitationAcceptance {
  applyCookies(headers: Headers): void;
}
interface ServerSocialIdTokenSession extends AuthSession {
  applyCookies(headers: Headers): void;
}
interface FinuevaServerAuth {
  acceptInvitation(input: AcceptInvitationInput): Promise<ServerInvitationAcceptance>;
  getSession(): Promise<AuthSession | null>;
  listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
  getOrganization(organizationId: string): Promise<AuthOrganization>;
  getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
  createOrganization(name: string, slug: string, idempotencyKey: string): Promise<CreatedOrganization>;
  createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
  createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
  resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
  cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
  removeOrganizationMember(organizationId: string, memberId: string, idempotencyKey: string): Promise<RemovedOrganizationMember>;
  leaveOrganization(organizationId: string, idempotencyKey: string): Promise<OrganizationDeparture>;
  updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
  updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
  listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
  listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
  listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
  listOrganizationInvitations(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationInvitationPage>;
  getOrganizationInvitation(organizationId: string, invitationId: string): Promise<OrganizationInvitation>;
  listReceivedInvitations(input?: OrganizationPageInput): Promise<ReceivedOrganizationInvitationPage>;
  getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
  signInWithSocialIdToken(input: SocialIdTokenInput): Promise<ServerSocialIdTokenSession>;
  getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
  getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
  signOut(): Promise<ServerSignOutResult>;
}
declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
//#endregion
export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };