import 'server-only';
import { JWTPayload } from 'jose';
import { NextRequest } from 'next/server';
import { AuthkitMiddlewareAuth, AuthkitOptions, AuthkitResponse, NoUserInfo, Session, UserInfo } from './interfaces.js';
import type { AuthenticationResponse } from '@workos-inc/node';
declare function encryptSession(session: Session): Promise<string>;
declare function updateSessionMiddleware(request: NextRequest, debug: boolean, middlewareAuth: AuthkitMiddlewareAuth, redirectUri: string, signUpPaths: string[], eagerAuth?: boolean, refreshBufferSeconds?: number): Promise<import("next/server.js").NextResponse<unknown>>;
declare function updateSession(request: NextRequest, options?: AuthkitOptions): Promise<AuthkitResponse>;
declare function refreshSession(options: {
    organizationId?: string;
    ensureSignedIn: true;
}): Promise<UserInfo>;
declare function refreshSession(options?: {
    organizationId?: string;
    ensureSignedIn?: boolean;
}): Promise<UserInfo | NoUserInfo>;
export declare function getTokenClaims<T = Record<string, unknown>>(accessToken?: string): Promise<Partial<JWTPayload & T>>;
/**
 * Check how recently the current user authenticated, using the `auth_time`
 * claim on the access token. Returns data only — it never redirects — so it is
 * safe to call as the enforcement step inside a sensitive server action or in a
 * server component where you decide what to do.
 *
 * @example
 * ```typescript
 * // Guard a sensitive server action
 * const { isStale } = await checkRecentAuth({ maxAge: 300 });
 * if (isStale) {
 *   return { status: 'reauth_required' };
 * }
 * ```
 *
 * @remarks
 * To send the user through re-authentication, redirect to your sign-in route
 * with `maxAge` (e.g. `getSignInUrl({ maxAge: 300 })`), which forwards OIDC
 * `max_age` so the IdP forces a reauth when the most recent auth is older.
 *
 * Requires `@workos-inc/node` >= 10.7.0 for `maxAge` forwarding.
 */
export declare function checkRecentAuth({ maxAge }: {
    maxAge: number;
}): Promise<{
    readonly authenticatedAt: null;
    readonly isStale: true;
} | {
    readonly authenticatedAt: Date;
    readonly isStale: boolean;
}>;
declare function withAuth(options: {
    ensureSignedIn: true;
}): Promise<UserInfo>;
declare function withAuth(options?: {
    ensureSignedIn?: true | false;
}): Promise<UserInfo | NoUserInfo>;
/**
 * Determines whether a failed refresh is transient (should preserve the
 * session and be retried) rather than terminal (the refresh token is dead and
 * the user must re-authenticate).
 *
 * Mirrors the WorkOS SDK's own retry classification: transient HTTP responses
 * (request timeout normalized to `408`, `429`, and `5xx`) surface as an
 * exception carrying a retryable numeric `status`, and a network-level failure
 * surfaces as a `TypeError` (wrapped by the SDK in an `Error` with the
 * `TypeError` as its `cause`). Anything else (a terminal `invalid_grant` at
 * 400, a 401, or an unrecognized error) is treated as terminal.
 */
export declare function isTransientRefreshError(error: unknown): boolean;
export declare function getSessionFromCookie(request?: NextRequest): Promise<Session | undefined>;
/**
 * Saves a WorkOS session to a cookie for use with AuthKit.
 *
 * This function is intended for advanced use cases where you need to manually manage sessions,
 * such as custom authentication flows (email verification, etc.) that don't use
 * the standard AuthKit authentication flow.
 *
 * @param sessionOrResponse The WorkOS session or AuthenticationResponse containing access token, refresh token, and user information.
 * @param request Either a NextRequest object or a URL string, used to determine cookie settings.
 *
 * @example
 * // With a NextRequest object
 * import { saveSession } from '@workos-inc/authkit-nextjs';
 *
 * async function handleEmailVerification(req: NextRequest) {
 *   const { code } = await req.json();
 *   const authResponse = await workos.userManagement.authenticateWithEmailVerification({
 *     clientId: process.env.WORKOS_CLIENT_ID,
 *     code,
 *   });
 *
 *   await saveSession(authResponse, req);
 * }
 *
 * @example
 * // With a URL string
 * await saveSession(authResponse, 'https://example.com/callback');
 */
export declare function saveSession(sessionOrResponse: Session | AuthenticationResponse, request: NextRequest | string): Promise<void>;
export { encryptSession, refreshSession, updateSession, updateSessionMiddleware, withAuth };