export interface SessionInfo {
    sessionId: string;
    identityId: string;
    active: boolean;
    authenticatedAt: string;
    expiresAt?: string;
    authenticatorAssuranceLevel?: string;
    authenticationMethods?: Array<{
        method: string;
        completedAt?: string;
    }>;
    traits: Record<string, unknown>;
}
export interface OAuth2TokenInfo {
    active: boolean;
    clientId?: string;
    scope?: string;
    subject?: string;
    audience?: string[];
    expiresAt?: number;
    issuedAt?: number;
    tokenUse?: string;
    extra?: Record<string, unknown>;
}
export interface PermissionCheck {
    namespace: string;
    object: string;
    relation: string;
    subjectId?: string;
    subjectSet?: {
        namespace: string;
        object: string;
        relation: string;
    };
}
export interface PermissionResult {
    allowed: boolean;
    checkedAt: string;
    check: PermissionCheck;
}
export interface BatchPermissionResult {
    results: Array<{
        allowed: boolean;
        error?: string;
    }>;
    checks: PermissionCheck[];
    checkedAt: string;
}
export type OryErrorCode = "session_inactive" | "session_aal2_required" | "forbidden" | "rate_limited" | "not_found" | "network_error"
/**
 * TLS/certificate verification failed — an expired, self-signed, or otherwise
 * untrusted certificate on the project host. Distinct from `network_error`
 * because the posture differs: a socket-level blip is a transport failure and
 * fails open, whereas a certificate failure means we cannot establish *who we
 * are talking to*, so the check result cannot be trusted at all. It is also
 * precisely the failure an active network attacker produces, so under
 * `enforce` it denies rather than passing the tool through.
 */
 | "tls_error" | "unknown";
export interface OryError {
    code: OryErrorCode;
    status?: number;
    message: string;
    /** Ory backend request ID (x-request-id header) when available. */
    requestId?: string;
    cause?: unknown;
}