import { a1 as OAuthResult } from '../analytics-facade-B1s6ueXl.js';
import { NextRequest } from 'next/server';
import { P as PB } from '../pb-CEUOMPJ0.js';
import '../index.d-CS4ceNwT.js';
import '../storage-Nj6JAWej.js';
import './pooled-flags-ByrxSmnn.js';

/** Complete a proof-bound OAuth browser transaction in a Next.js Route Handler. */

interface HandleAuthCallbackOptions {
    /** Same-origin destination after success or error. Default '/'. */
    defaultNext?: string;
    /** Render or hand off the MFA challenge. By default it is returned as uncached JSON. */
    onMFARequired?: (result: Extract<OAuthResult, {
        status: 'mfaRequired';
    }>, request: NextRequest) => Response | Promise<Response>;
}
declare function handleAuthCallback(opts?: HandleAuthCallbackOptions): (request: NextRequest) => Promise<Response>;

declare function environmentRefFromApiKey(apiKey: string): string;

/**
 * Session-cookie codec shared by EVERY palbe/next surface (browser storage
 * adapter, pbServer cookie adapter, middleware, auth callback). Pure
 * functions — no 'next' imports, no palbe runtime imports — so both sides
 * provably read and write the SAME bytes.
 *
 * Format (P3 design contract):
 * - name: `palbe-session-<environmentRef>`; overflow chunk names append `.0`,
 *   `.1`, … (cookie names otherwise avoid dots — tooling friendliness).
 * - value: `encodeURIComponent(JSON.stringify({ a, r, e }))` with a=access
 *   token, r=refresh token, e=expiry (ms epoch).
 * - one cookie when the encoded value fits MAX_COOKIE_VALUE chars, else
 *   chunks ONLY (the base name must not coexist with chunks — callers clear
 *   stale names via clearedSessionCookieNames before writing, then honor the
 *   encode result's `clear` overflow guard after writing).
 */

interface StoredSession {
    accessToken: string;
    refreshToken: string;
    /** ms epoch */
    expiresAt: number;
}
/**
 * The P3 cookie contract attributes, shared by every server-side writer
 * (pbServer adapter, middleware, callback); the browser writer mirrors them
 * in document.cookie string form (next/client.ts). NOT HttpOnly by design —
 * the browser SDK must read/write the session (Supabase-paradigm tradeoff);
 * Max-Age = 30d = the refresh-token TTL.
 */
declare const SESSION_COOKIE_ATTRS: {
    readonly path: "/";
    readonly sameSite: "lax";
    readonly secure: true;
    readonly maxAge: 2592000;
};
declare function sessionCookieName(environmentRef: string): string;
interface SessionCookieWrite {
    /** Cookies to SET, in order. */
    set: Array<{
        name: string;
        value: string;
    }>;
    /**
     * Names to DELETE alongside the set: the one-past-the-end OVERFLOW GUARD
     * (base write → `.0`; chunks `.0..n` → `.(n+1)`). Decode stops at the
     * first missing chunk, so deleting exactly one-past-the-end guarantees a
     * stale orphan chunk (left behind a gap, where presence-probing cleanup
     * cannot see it) can never concatenate into the freshly written run.
     * Writers MUST honor both lists.
     */
    clear: string[];
}
declare function encodeSessionCookies(environmentRef: string, session: StoredSession): SessionCookieWrite;
/**
 * encodeSessionCookies for percent-ENCODING cookie stores. Next's request
 * and response cookie APIs apply encodeURIComponent to values when
 * serializing (and decodeURIComponent on read) — handing them the codec's
 * already-encoded values would DOUBLE-encode the wire bytes and break the
 * browser-side reader. This variant returns the same cookie run with
 * DECODED values: `encodeURIComponent(value)` reproduces the
 * encodeSessionCookies bytes exactly (chunk boundaries never split an
 * escape), so an encoding store writes byte-identical cookies to a raw
 * writer like document.cookie.
 */
declare function encodeSessionCookiesDecoded(environmentRef: string, session: StoredSession): SessionCookieWrite;
/**
 * Read the session back from a cookie getter: the base name wins; otherwise
 * `.0`, `.1`, … are concatenated until the first missing chunk. Tolerant:
 * malformed URI escapes / JSON / shape → null (treated as "no session").
 *
 * Accepts BOTH value forms. Next's cookie stores percent-DECODE values once
 * on read, so server-side callers (pbServer adapter, middleware) hand us the
 * already-decoded JSON; raw readers (document.cookie) hand us the encoded
 * form. The raw (already-decoded) parse runs FIRST because it is
 * unambiguous — an encoded value can never raw-parse as JSON
 * (encodeURIComponent escapes `{` itself, so it starts with `%7B`) — whereas
 * decode-first would silently corrupt a literal `%XX` run inside a token
 * (decodeURIComponent('%41') → 'A', no throw) or throw on an invalid escape.
 */
declare function decodeSessionCookies(get: (name: string) => string | undefined, environmentRef: string): StoredSession | null;
/**
 * Names a writer must delete before/while writing: the base name (when
 * present) plus every existing `.N` chunk, probed in order until the first
 * missing one (writes are always a contiguous `.0..n` run, so a gap means
 * the end of palbe-owned chunks).
 */
declare function clearedSessionCookieNames(environmentRef: string, present: (name: string) => boolean): string[];

/**
 * Structural slice of Next's request cookie store (`await cookies()`); any
 * object honoring it works — the seam for tests and non-Next servers.
 * `set`/`delete` are optional because RSC-scope stores are read-only.
 */
interface CookieStoreLike {
    get(name: string): {
        name: string;
        value: string;
    } | undefined;
    getAll?(): Array<{
        name: string;
        value: string;
    }>;
    set?(name: string, value: string, options?: Record<string, unknown>): void;
    delete?(name: string): void;
}
/**
 * Build a per-request `PB` client over the request's cookies. Reads the
 * session the browser SDK wrote (shared cookie codec), refreshes pre-flight
 * when expired, and — where the store is writable (Server Actions, Route
 * Handlers) — persists the rotated session back.
 *
 * Each call builds a fresh runtime (a handful of small objects, no I/O) —
 * cheap enough to call per data access; code paths invoking it many times
 * within one request MAY memoize per-request (e.g. React's `cache()`), but
 * don't have to.
 *
 * ```ts
 * const pb = await pbServer();
 * const todos = await pb.todos.list();
 * ```
 */
declare function pbServer(opts?: {
    cookies?: CookieStoreLike;
}): Promise<PB>;

export { type CookieStoreLike, type HandleAuthCallbackOptions, SESSION_COOKIE_ATTRS, type SessionCookieWrite, type StoredSession, clearedSessionCookieNames, decodeSessionCookies, encodeSessionCookies, encodeSessionCookiesDecoded, environmentRefFromApiKey, handleAuthCallback, pbServer, sessionCookieName };