import { n as SDKError } from "./index-BFYASYJk.js";
import { z } from "zod";
//#region src/auth/shared-providers.d.ts
/** Auth provider interface */
interface AuthProvider {
  /** Get current token (called on each request) */
  getToken(): Promise<string | null>;
  /** Refresh expired token */
  refreshToken?(): Promise<string>;
  /** Called when token is rejected by server */
  onTokenRejected?(error: SDKError): Promise<void>;
}
/** Simple static token auth */
declare class StaticTokenAuth implements AuthProvider {
  private token;
  constructor(token: string);
  getToken(): Promise<string>;
  setToken(token: string): void;
}
/** Token with refresh capability */
declare class RefreshableTokenAuth implements AuthProvider {
  private config;
  private accessToken;
  private refreshTokenValue;
  private expiresAt;
  private refreshPromise;
  constructor(config: {
    accessToken: string;
    refreshToken: string;
    expiresIn: number;
    onRefresh: (refreshToken: string) => Promise<{
      accessToken: string;
      refreshToken?: string;
      expiresIn: number;
    }>;
    onRefreshFailed?: (error: Error) => void;
    /** Buffer before expiry to trigger refresh (default: 60s) */
    refreshBuffer?: number;
  });
  getToken(): Promise<string>;
  refreshToken(): Promise<string>;
  private doRefresh;
  onTokenRejected(error: SDKError): Promise<void>;
  /** Check if token needs refresh */
  isExpired(): boolean;
}
/** No auth (for public endpoints) */
declare class NoAuth implements AuthProvider {
  getToken(): Promise<null>;
}
/**
 * Callback-based auth for dynamic token retrieval.
 * Useful when token comes from external source (user session, secure storage).
 */
declare class CallbackAuth implements AuthProvider {
  private getTokenFn;
  constructor(getTokenFn: () => string | null | Promise<string | null>);
  getToken(): Promise<string | null>;
}
/**
 * Read token auth for WebSocket connections.
 * Wraps a read token with refresh capability.
 */
declare class ReadTokenAuth implements AuthProvider {
  private config;
  private token;
  private expiresAt;
  private refreshPromise;
  private expiryWarned;
  constructor(config: {
    token: string;
    expiresAt: number;
    onRefresh: () => Promise<{
      token: string;
      expiresAt: number;
    }>;
    onExpiring?: (secondsRemaining: number) => void;
    onRefreshFailed?: (error: Error) => void;
    /** Buffer before expiry to trigger refresh (default: 60s) */
    refreshBuffer?: number;
    /** Buffer before expiry to trigger warning (default: 60s) */
    warningBuffer?: number;
  });
  getToken(): Promise<string>;
  refreshToken(): Promise<string>;
  private doRefresh;
  /** Check if token is expired */
  isExpired(): boolean;
  /** Get seconds until expiry */
  getSecondsRemaining(): number;
}
//#endregion
//#region src/auth/types.d.ts
/**
 * Product configuration for multi-tenant orchestrator.
 */
declare const ProductSchema: z.ZodObject<{
  product_id: z.ZodString;
  name: z.ZodString;
  api_key: z.ZodString;
  secrets: z.ZodObject<{
    current: z.ZodObject<{
      secret: z.ZodString;
      created_at: z.ZodNumber;
    }, z.core.$strip>;
    previous: z.ZodOptional<z.ZodObject<{
      secret: z.ZodString;
      created_at: z.ZodNumber;
      expires_at: z.ZodNumber;
    }, z.core.$strip>>;
  }, z.core.$strip>;
  token_config: z.ZodObject<{
    free_ttl_minutes: z.ZodDefault<z.ZodNumber>;
    paid_ttl_minutes: z.ZodDefault<z.ZodNumber>;
    max_ttl_minutes: z.ZodDefault<z.ZodNumber>;
  }, z.core.$strip>;
  rate_limits: z.ZodObject<{
    max_concurrent_sessions: z.ZodDefault<z.ZodNumber>;
    max_sessions_per_minute: z.ZodDefault<z.ZodNumber>;
    max_requests_per_minute: z.ZodDefault<z.ZodNumber>;
  }, z.core.$strip>;
  unlimited: z.ZodDefault<z.ZodBoolean>;
  internal_notes: z.ZodOptional<z.ZodString>;
  webhook_url: z.ZodOptional<z.ZodString>;
  status: z.ZodDefault<z.ZodEnum<{
    active: "active";
    deleted: "deleted";
    suspended: "suspended";
  }>>;
  deployment_type: z.ZodDefault<z.ZodEnum<{
    "customer-hosted": "customer-hosted";
    shared: "shared";
  }>>;
  customer_orchestrator: z.ZodOptional<z.ZodObject<{
    url: z.ZodString;
    api_key: z.ZodString;
  }, z.core.$strip>>;
  created_at: z.ZodString;
  updated_at: z.ZodString;
}, z.core.$strip>;
type Product = z.infer<typeof ProductSchema>;
/**
 * Token scope types for multi-tenant access control.
 *
 * - "session": Access to a single session (requires sid)
 * - "project": Access to all sessions within a project (requires projectId)
 * - "batch": Access to multiple projects (requires projectIds array)
 */
type TokenScope = "session" | "project" | "batch";
/**
 * Session-scoped token payload.
 * Grants access to a single session's events.
 */
declare const SessionScopedTokenPayloadSchema: z.ZodObject<{
  sub: z.ZodString;
  pid: z.ZodString;
  cid: z.ZodOptional<z.ZodString>;
  typ: z.ZodLiteral<"read">;
  iat: z.ZodNumber;
  exp: z.ZodNumber;
  sid: z.ZodString;
  projectId: z.ZodOptional<z.ZodUndefined>;
  projectIds: z.ZodOptional<z.ZodUndefined>;
}, z.core.$strip>;
/**
 * Project-scoped token payload.
 * Grants access to all sessions within a single project.
 */
declare const ProjectScopedTokenPayloadSchema: z.ZodObject<{
  sub: z.ZodString;
  pid: z.ZodString;
  cid: z.ZodOptional<z.ZodString>;
  typ: z.ZodLiteral<"read">;
  iat: z.ZodNumber;
  exp: z.ZodNumber;
  sid: z.ZodOptional<z.ZodUndefined>;
  projectId: z.ZodString;
  projectIds: z.ZodOptional<z.ZodUndefined>;
}, z.core.$strip>;
/**
 * Batch-scoped token payload.
 * Grants access to multiple projects (organization-level access).
 */
declare const BatchScopedTokenPayloadSchema: z.ZodObject<{
  sub: z.ZodString;
  pid: z.ZodString;
  cid: z.ZodOptional<z.ZodString>;
  typ: z.ZodLiteral<"read">;
  iat: z.ZodNumber;
  exp: z.ZodNumber;
  sid: z.ZodOptional<z.ZodUndefined>;
  projectId: z.ZodOptional<z.ZodUndefined>;
  projectIds: z.ZodArray<z.ZodString>;
}, z.core.$strip>;
/**
 * Read token payload (JWT claims for WebSocket auth).
 *
 * Supports three scopes:
 * - Session: sid present (single session)
 * - Project: projectId present (all sessions in project)
 * - Batch: projectIds present (multiple projects)
 *
 * For backwards compatibility, tokens with sid are session-scoped.
 */
declare const ReadTokenPayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
  sub: z.ZodString;
  pid: z.ZodString;
  cid: z.ZodOptional<z.ZodString>;
  typ: z.ZodLiteral<"read">;
  iat: z.ZodNumber;
  exp: z.ZodNumber;
  sid: z.ZodString;
  projectId: z.ZodOptional<z.ZodUndefined>;
  projectIds: z.ZodOptional<z.ZodUndefined>;
}, z.core.$strip>, z.ZodObject<{
  sub: z.ZodString;
  pid: z.ZodString;
  cid: z.ZodOptional<z.ZodString>;
  typ: z.ZodLiteral<"read">;
  iat: z.ZodNumber;
  exp: z.ZodNumber;
  sid: z.ZodOptional<z.ZodUndefined>;
  projectId: z.ZodString;
  projectIds: z.ZodOptional<z.ZodUndefined>;
}, z.core.$strip>, z.ZodObject<{
  sub: z.ZodString;
  pid: z.ZodString;
  cid: z.ZodOptional<z.ZodString>;
  typ: z.ZodLiteral<"read">;
  iat: z.ZodNumber;
  exp: z.ZodNumber;
  sid: z.ZodOptional<z.ZodUndefined>;
  projectId: z.ZodOptional<z.ZodUndefined>;
  projectIds: z.ZodArray<z.ZodString>;
}, z.core.$strip>]>;
type ReadTokenPayload = z.infer<typeof ReadTokenPayloadSchema>;
type SessionScopedTokenPayload = z.infer<typeof SessionScopedTokenPayloadSchema>;
type ProjectScopedTokenPayload = z.infer<typeof ProjectScopedTokenPayloadSchema>;
type BatchScopedTokenPayload = z.infer<typeof BatchScopedTokenPayloadSchema>;
/**
 * Token validation result.
 */
interface TokenValidationResult {
  valid: boolean;
  payload?: ReadTokenPayload;
  /** Token scope (session, project, or batch) */
  scope?: TokenScope;
  error?: string;
  errorCode?: "TOKEN_MISSING" | "TOKEN_INVALID" | "TOKEN_EXPIRED" | "TOKEN_WRONG_TYPE" | "PRODUCT_NOT_FOUND" | "PRODUCT_SUSPENDED" | "SIGNATURE_INVALID";
}
/**
 * Product secrets structure.
 */
interface ProductSecrets {
  current: {
    secret: string;
    created_at: number;
  };
  previous?: {
    secret: string;
    created_at: number;
    expires_at: number;
  };
}
/**
 * Minimal product info for token validation (avoids full product lookup).
 */
interface ProductAuthInfo {
  product_id: string;
  secrets: ProductSecrets;
  status: "active" | "suspended" | "deleted";
}
/**
 * Session creation request from product backend.
 */
declare const CreateSessionRequestSchema: z.ZodObject<{
  user_id: z.ZodString;
  project_ref: z.ZodOptional<z.ZodString>;
  tier: z.ZodDefault<z.ZodUnion<[z.ZodEnum<{
    enterprise: "enterprise";
    free: "free";
    pro: "pro";
  }>, z.ZodPipe<z.ZodLiteral<"paid">, z.ZodTransform<"pro", "paid">>]>>;
  config: z.ZodOptional<z.ZodObject<{
    image: z.ZodOptional<z.ZodString>;
    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    resources: z.ZodOptional<z.ZodObject<{
      cpu: z.ZodOptional<z.ZodNumber>;
      memory: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>>;
  }, z.core.$strip>>;
}, z.core.$strip>;
type CreateSessionRequest = z.infer<typeof CreateSessionRequestSchema>;
/**
 * Session creation response to product backend.
 */
interface CreateSessionResponse {
  session_id: string;
  sidecar_id: string;
  websocket_url: string;
}
/**
 * Message send request from product backend.
 *
 * `metadata` is intentionally free-form (.passthrough): the wire format
 * accepts arbitrary product-specific keys without requiring a schema bump.
 * Only `model` is named today; legacy gateway-credential fields previously
 * declared here were never read internally and have been dropped — any
 * such fields sent by older callers continue to flow through .passthrough.
 */
declare const SendMessageRequestSchema: z.ZodObject<{
  content: z.ZodString;
  user_id: z.ZodString;
  execution_id: z.ZodOptional<z.ZodString>;
  metadata: z.ZodOptional<z.ZodObject<{
    model: z.ZodOptional<z.ZodString>;
  }, z.core.$loose>>;
}, z.core.$strip>;
type SendMessageRequest = z.infer<typeof SendMessageRequestSchema>;
//#endregion
//#region src/auth/tokens-browser.d.ts
/**
 * Decode a JWT without verifying it, to read claims for lookup.
 * Returns null if the token is malformed.
 */
declare function decodeToken(token: string): ReadTokenPayload | null;
/**
 * Get time until token expires (in seconds).
 * Returns negative if expired.
 */
declare function getTokenTTL(payload: ReadTokenPayload): number;
/**
 * Check if token is expiring soon (within buffer seconds).
 */
declare function isTokenExpiringSoon(payload: ReadTokenPayload, bufferSeconds?: number): boolean;
//#endregion
export { AuthProvider as C, RefreshableTokenAuth as D, ReadTokenAuth as E, StaticTokenAuth as O, TokenValidationResult as S, NoAuth as T, SendMessageRequest as _, BatchScopedTokenPayloadSchema as a, SessionScopedTokenPayloadSchema as b, CreateSessionResponse as c, ProductSchema as d, ProductSecrets as f, ReadTokenPayloadSchema as g, ReadTokenPayload as h, BatchScopedTokenPayload as i, Product as l, ProjectScopedTokenPayloadSchema as m, getTokenTTL as n, CreateSessionRequest as o, ProjectScopedTokenPayload as p, isTokenExpiringSoon as r, CreateSessionRequestSchema as s, decodeToken as t, ProductAuthInfo as u, SendMessageRequestSchema as v, CallbackAuth as w, TokenScope as x, SessionScopedTokenPayload as y };
//# sourceMappingURL=tokens-browser-DCV3-WHc.d.ts.map