import { AuthStrategy } from '@voltro/protocol';

/** Common claims surfaced by Kinde tokens. Permissive shape because
 *  Kinde adds claims over time and via custom mappers. */
export declare interface KindeClaims {
    readonly sub: string;
    readonly iss?: string;
    readonly email?: string;
    readonly org_code?: string;
    readonly org_codes?: ReadonlyArray<string>;
    readonly permissions?: ReadonlyArray<string>;
    readonly roles?: ReadonlyArray<{
        id: string;
        key: string;
        name: string;
    }>;
    readonly [key: string]: unknown;
}

export declare const kindeStrategy: (options: KindeStrategyOptions) => AuthStrategy;

export declare interface KindeStrategyOptions {
    /** Kinde issuer URL, e.g. `https://yourcompany.kinde.com`. No
     *  trailing slash (the factory normalises). */
    readonly issuer: string;
    /** Audience claim. Kinde sets this to your "API audience" string.
     *  Usually the same as the issuer for first-party APIs. */
    readonly audience?: string;
    /** Override the JWKS URL. Default: `<issuer>/.well-known/jwks`. */
    readonly jwksUrl?: string;
    /** JWT algorithm allowlist. Defaults to `['RS256']` — Kinde signs
     *  RS256. Override only for a Kinde setup configured with a different
     *  signing algorithm. */
    readonly algorithms?: ReadonlyArray<'ES256' | 'RS256' | 'PS256' | 'EdDSA'>;
    /** Cookie that mirrors the access token for SSR. Default:
     *  `kinde_access_token`. Pass `null` to disable cookie fallback. */
    readonly cookieName?: string | null;
    /** Map Kinde claims → Voltro tenantId. Defaults to `claims.org_code`,
     *  falling back to `defaultTenantId`. */
    readonly tenantIdFromClaims?: (claims: KindeClaims) => string | null;
    /** Fallback tenantId for single-tenant Kinde setups. */
    readonly defaultTenantId?: string;
    /** Map Kinde claims → the subject's permission scopes. Lands on
     *  `Subject.scopes` so `requireScope` / `hasScope` gate handlers off
     *  the token with no second lookup. Kinde emits a `permissions` array
     *  and a `roles` list (map e.g. `roles.map((r) => r.key)`). Omitted →
     *  no scopes (a scope gate then denies). */
    readonly scopesFromClaims?: (claims: KindeClaims) => ReadonlyArray<string>;
}

export { }