import * as next_auth from 'next-auth';
export { d as debugServiceTokenClaims, g as getClientCredentialsToken } from './service-token-BANrKR5z.js';

/**
 * @typedef {Object} CmsAuthMeta
 * @property {string|null} adminRole
 * @property {((session: *) => boolean)|null} isAdmin
 */
/**
 * @typedef {Object} CreateCmsAuthOptionsInput
 * @property {*} provider
 *   Configured NextAuth provider instance. Import the provider module on
 *   the consumer side (typically `next-auth/providers/keycloak`) and pass
 *   the result of calling it. Required.
 * @property {string} [adminRole]
 *   Keycloak client role required for admin access. Default `"cms:access"`.
 * @property {(session: *) => boolean} [isAdmin]
 *   Override admin gating with arbitrary logic. Wins over `adminRole`.
 * @property {number} [refreshLeadTimeMs]
 *   Refresh access tokens this many ms before expiry. Default 10 000.
 * @property {string|false} [signInPage]
 *   Path NextAuth redirects unauthenticated users to. Defaults to
 *   `"/api/signin"` (the package's auto-submit route) so sign-in jumps straight
 *   into Keycloak instead of NextAuth's built-in "Sign in with X" picker. Set
 *   `false` to keep the picker.
 * @property {Partial<import("next-auth").AuthOptions["callbacks"]>} [extraCallbacks]
 *   Extra callbacks merged on top of the built-in ones. Each callback runs
 *   AFTER the built-in version and receives the already-augmented value.
 * @property {Partial<import("next-auth").AuthOptions>} [extraOptions]
 *   Anything else (pages, cookies, events, ...) merged onto the result.
 */
/**
 * Build a ready-to-use NextAuth `AuthOptions` object.
 *
 * @param {CreateCmsAuthOptionsInput} input
 * @returns {import("next-auth").AuthOptions & { [CMS_META]: CmsAuthMeta }}
 */
declare function createCmsAuthOptions(input: CreateCmsAuthOptionsInput): next_auth.AuthOptions & {
    [CMS_META]: CmsAuthMeta;
};
/**
 * Read CMS admin metadata previously stamped by `createCmsAuthOptions`.
 * Returns null if the options didn't come from the factory.
 *
 * @param {*} authOptions
 * @returns {CmsAuthMeta|null}
 */
declare function readCmsAuthMeta(authOptions: any): CmsAuthMeta | null;
/**
 * Decide whether a session belongs to a CMS admin. Uses `isAdmin` callback
 * when provided, otherwise checks for the named Keycloak client role.
 * Falls back to `false` when no metadata is available.
 *
 * @param {*} session
 * @param {CmsAuthMeta|null} [meta]
 * @returns {boolean}
 */
declare function isCmsAdmin(session: any, meta?: CmsAuthMeta | null): boolean;
/**
 * Adapt NextAuth `authOptions` into the auth-agnostic callbacks
 * `createCmsPage` expects, so the inscribed core never has to import next-auth.
 * Spread the result into the factory:
 *
 *   import { withCmsAuth } from "@skylab-kulubu/inscribed-auth/server";
 *   createCmsPage({ ...withCmsAuth(authOptions), config, Provider, ... });
 *
 * - `getSession` resolves the server session via `getServerSession`.
 * - `deriveAdmin` uses the admin metadata stamped by `createCmsAuthOptions`
 *   (falls back to `session != null` when the options didn't come from the
 *   factory).
 * - `deriveUserSub` reads `session.user.id`.
 *
 * @param {import("next-auth").AuthOptions} authOptions
 * @returns {{ getSession: () => Promise<*|null>, deriveAdmin: (session: *) => boolean, deriveUserSub: (session: *) => string | null }}
 */
declare function withCmsAuth(authOptions: next_auth.AuthOptions): {
    getSession: () => Promise<any | null>;
    deriveAdmin: (session: any) => boolean;
    deriveUserSub: (session: any) => string | null;
};
type CmsAuthMeta = {
    adminRole: string | null;
    isAdmin: ((session: any) => boolean) | null;
};
type CreateCmsAuthOptionsInput = {
    /**
     *   Configured NextAuth provider instance. Import the provider module on
     *   the consumer side (typically `next-auth/providers/keycloak`) and pass
     *   the result of calling it. Required.
     */
    provider: any;
    /**
     * Keycloak client role required for admin access. Default `"cms:access"`.
     */
    adminRole?: string | undefined;
    /**
     * Override admin gating with arbitrary logic. Wins over `adminRole`.
     */
    isAdmin?: ((session: any) => boolean) | undefined;
    /**
     * Refresh access tokens this many ms before expiry. Default 10 000.
     */
    refreshLeadTimeMs?: number | undefined;
    /**
     * Path NextAuth redirects unauthenticated users to. Defaults to
     * `"/api/signin"` (the package's auto-submit route) so sign-in jumps straight
     * into Keycloak instead of NextAuth's built-in "Sign in with X" picker. Set
     * `false` to keep the picker.
     */
    signInPage?: string | false | undefined;
    /**
     * Extra callbacks merged on top of the built-in ones. Each callback runs
     * AFTER the built-in version and receives the already-augmented value.
     */
    extraCallbacks?: Partial<next_auth.AuthOptions["callbacks"]>;
    /**
     * Anything else (pages, cookies, events, ...) merged onto the result.
     */
    extraOptions?: Partial<next_auth.NextAuthOptions> | undefined;
};
/** @type {unique symbol} */
declare const CMS_META: unique symbol;

export { createCmsAuthOptions, isCmsAdmin, readCmsAuthMeta, withCmsAuth };