import { AuthStrategy } from '@voltro/protocol';

/** Permissive shape of Clerk session tokens. Custom claims via JWT
 *  Templates land in this same object alongside Clerk's defaults. */
export declare interface ClerkClaims {
    readonly sub: string;
    readonly iss?: string;
    readonly sid?: string;
    readonly email?: string;
    readonly org_id?: string;
    readonly org_slug?: string;
    readonly org_role?: string;
    readonly org_permissions?: ReadonlyArray<string>;
    readonly [key: string]: unknown;
}

export declare const clerkStrategy: (options: ClerkStrategyOptions) => AuthStrategy;

export declare interface ClerkStrategyOptions {
    /** Clerk Frontend API URL, e.g. `https://clerk.myapp.com` or
     *  `https://something-1234.clerk.accounts.dev`. No trailing slash
     *  (the factory normalises). */
    readonly frontendApi: string;
    /** Override the JWKS URL. Default:
     *  `<frontendApi>/.well-known/jwks.json`. */
    readonly jwksUrl?: string;
    /** Override the expected issuer. Default: `<frontendApi>` (Clerk's
     *  default — issuer mirrors the Frontend API host). */
    readonly issuer?: string;
    /** Optional audience claim — only set this when you've enabled
     *  Clerk's "JWT Templates" feature and set an audience there.
     *  Default `__session` tokens are issued without an `aud` claim. */
    readonly audience?: string;
    /** JWT algorithm allowlist. Defaults to `['RS256', 'ES256']` — Clerk
     *  signs RS256 by default; ES256 covers instances configured for EC keys.
     *  Override only for a Clerk setup with a different signing algorithm. */
    readonly algorithms?: ReadonlyArray<'ES256' | 'RS256' | 'PS256' | 'EdDSA'>;
    /** Cookie name. Default: `__session` (Clerk's hardcoded name). */
    readonly cookieName?: string | null;
    /** Map Clerk claims → Voltro tenantId. Clerk's "Organizations"
     *  feature sets `org_id`; multi-tenant apps usually use that.
     *  Single-tenant Clerk users supply `defaultTenantId`. */
    readonly tenantIdFromClaims?: (claims: ClerkClaims) => string | null;
    /** Fallback tenantId when no `org_id` claim is present. */
    readonly defaultTenantId?: string;
    /** Map Clerk claims → the subject's permission scopes. Lands on
     *  `Subject.scopes` so `requireScope` / `hasScope` gate handlers off the
     *  token with no second lookup. Clerk's Organizations feature emits
     *  `org_role` / `org_permissions`; JWT Templates can add a custom
     *  `permissions` claim (e.g. `(c) => c.org_permissions ?? []`). Omitted →
     *  no scopes (a scope gate then denies). */
    readonly scopesFromClaims?: (claims: ClerkClaims) => ReadonlyArray<string>;
}

export { }