import { C as SignedOutAuth, S as SignedInAuth, _ as RedirectToSignInOptions, b as SignInOptions, c as AuthKitAuth, d as AuthkitMiddlewareOptions, f as CallbackHandlerOptions, g as ProtectedRoutes, h as HasCheckParams, i as ClientUser, l as AuthKitConfig, m as CookieContext, p as CallbackSuccess, r as ClientAuth, t as AuthCondition, u as AuthKitMiddlewareHandler, v as SessionClaims, x as SignOutHandlerOptions, y as SessionContext } from "./shared-CWMH5N-C.js";
import { WorkOS, createAuthService } from "@workos/authkit-session";
import { APIContext, APIRoute, AstroIntegration, MiddlewareHandler } from "astro";
import { Event } from "@workos-inc/node";
export type * from "@workos/authkit-session";

//#region src/integration.d.ts
/** Options for the `@workos/authkit-astro` Astro integration. */
interface AuthkitIntegrationOptions {
  /**
   * Routes that require a signed-in user (anonymous visitors are redirected
   * to `signInPath`). Plain strings are path prefixes; `path-to-regexp` 6.x
   * patterns (`/dashboard(.*)`, `/orgs/:slug`) match the full pathname. For
   * RegExp / predicate matching, wire `authkitMiddleware` manually instead.
   */
  protectedRoutes?: string[];
  /** Where to redirect unauthenticated visitors (default `/login`). */
  signInPath?: string;
  /** Route patterns for the injected handlers. */
  loginPath?: string;
  signUpPath?: string;
  callbackPath?: string;
  logoutPath?: string;
  /** Where to land after signing out (default `/`). */
  afterSignOutUrl?: string;
  /**
   * On callback failure, redirect here (with `?error=` appended) instead of
   * returning a 400 response.
   */
  errorRedirect?: string;
  /** Client session endpoint used by the auth store (default `/_authkit/me`). */
  sessionEndpoint?: string;
  /** Inject the login/signup/callback/logout routes (default `true`). */
  injectRoutes?: boolean;
  /** Declare the WORKOS_* secrets in `astro:env` (default `true`). */
  injectEnvSchema?: boolean;
  /** Inject the session endpoint + client hydration script (default `true`). */
  hydrateClient?: boolean;
}
/**
 * WorkOS AuthKit integration for Astro.
 *
 * Auto-wires the auth middleware, the login/signup/callback/logout routes, the
 * client session endpoint, and the `astro:env` secret schema — so a consuming
 * app needs only env vars and (optionally) the client store.
 *
 * @example
 * ```js
 * // astro.config.mjs
 * import authkit from '@workos/authkit-astro';
 * export default defineConfig({
 *   integrations: [authkit({ protectedRoutes: ['/dashboard'] })],
 * });
 * ```
 */
declare function authkit(options?: AuthkitIntegrationOptions): AstroIntegration;
//#endregion
//#region src/config.d.ts
/**
 * Configure AuthKit explicitly. Call this once, before the middleware runs
 * (typically at the top of `src/middleware.ts`, or done for you by the
 * integration), passing values from `astro:env/server`.
 *
 * This writes to `@workos/authkit-session`'s shared configuration provider, so
 * configuring once — e.g. in the middleware entry — is visible to every route
 * handler in the app (the middleware always runs first).
 */
declare function configureAuthKit(config: AuthKitConfig): void;
/**
 * The configured WorkOS Node client — the full WorkOS API (User Management,
 * Organizations, Directory Sync, …) without instantiating a second client.
 *
 * @example
 * ```ts
 * import { getWorkOS } from '@workos/authkit-astro';
 * const org = await getWorkOS().organizations.getOrganization(orgId);
 * ```
 */
declare function getWorkOS(): WorkOS;
//#endregion
//#region src/middleware.d.ts
/**
 * Astro middleware that validates the WorkOS session on every request,
 * populates `Astro.locals.auth`, refreshes expiring tokens, and (optionally)
 * gates protected routes.
 *
 * Anonymous requests to a protected route are redirected to `signInPath` when
 * they accept HTML, and receive a 401 JSON response otherwise.
 *
 * Pass a handler for full per-request control — it runs after `locals.auth`
 * is populated (and after the `protectedRoutes` gate, if configured):
 *
 * @example
 * ```ts
 * // src/middleware.ts
 * import { authkitMiddleware, createRouteMatcher } from '@workos/authkit-astro';
 *
 * const isAdminRoute = createRouteMatcher(['/admin(.*)']);
 *
 * export const onRequest = authkitMiddleware((auth, context) => {
 *   if (isAdminRoute(context.url) && !auth.has({ role: 'admin' })) {
 *     return auth.redirectToSignIn();
 *   }
 * });
 * ```
 */
declare function authkitMiddleware(options?: AuthkitMiddlewareOptions): MiddlewareHandler;
declare function authkitMiddleware(handler: AuthKitMiddlewareHandler, options?: AuthkitMiddlewareOptions): MiddlewareHandler;
//#endregion
//#region src/matcher.d.ts
/** Accepted by a route matcher: a pathname, URL, `Request`, or `APIContext`. */
type RouteMatcherInput = string | URL | {
  url: URL | string;
};
/**
 * Build a reusable route matcher from the same patterns `protectedRoutes`
 * accepts — plain-string prefixes, `path-to-regexp` 6.x strings
 * (`/dashboard(.*)`, `/orgs/:slug`), RegExps, or a pathname predicate.
 *
 * @example
 * ```ts
 * const isProtected = createRouteMatcher(['/dashboard(.*)', '/forum(.*)']);
 * export const onRequest = authkitMiddleware((auth, context) => {
 *   if (!auth.user && isProtected(context.url)) return auth.redirectToSignIn();
 * });
 * ```
 */
declare function createRouteMatcher(routes: ProtectedRoutes): (input: RouteMatcherInput) => boolean;
//#endregion
//#region src/auth.d.ts
/**
 * Switch the session's active organization. Refreshes the access token scoped
 * to `organizationId`, persists the new session cookie, updates
 * `context.locals.auth`, and returns the new auth state.
 *
 * Throws when there is no active session, or when WorkOS rejects the switch
 * (e.g. the user is not a member, or the organization enforces SSO).
 *
 * @example
 * ```ts
 * // src/pages/api/switch-org.ts
 * import { switchToOrganization } from '@workos/authkit-astro';
 * export const POST: APIRoute = async (context) => {
 *   const { organizationId } = await context.request.json();
 *   const auth = await switchToOrganization(context, organizationId);
 *   return Response.json({ organizationId: auth.organizationId });
 * };
 * ```
 */
declare function switchToOrganization(context: SessionContext, organizationId: string): Promise<AuthKitAuth>;
//#endregion
//#region src/routes.d.ts
/**
 * Build the WorkOS sign-in URL and write the PKCE verifier cookie to
 * `context.cookies`. Use from a `.astro` file or endpoint to render a custom
 * sign-in link:
 *
 * @example
 * ```astro
 * ---
 * import { getSignInUrl } from '@workos/authkit-astro';
 * const signInUrl = await getSignInUrl(Astro, { returnTo: '/dashboard' });
 * ---
 * <a href={signInUrl}>Sign in</a>
 * ```
 */
declare function getSignInUrl(context: CookieContext, options?: SignInOptions): Promise<string>;
/** Like {@link getSignInUrl}, but opens the sign-up screen. */
declare function getSignUpUrl(context: CookieContext, options?: SignInOptions): Promise<string>;
/**
 * Drop-in GET handler that redirects to WorkOS sign-in.
 * @example `// src/pages/login.ts` → `export { handleSignIn as GET } from '@workos/authkit-astro';`
 */
declare const handleSignIn: APIRoute;
/** Drop-in GET handler that redirects to WorkOS sign-up. */
declare const handleSignUp: APIRoute;
/**
 * Build a callback GET handler with custom behaviour — an error redirect
 * instead of a 400, or `onSuccess` / `onError` hooks.
 *
 * @example
 * ```ts
 * // src/pages/callback.ts
 * import { createCallbackHandler } from '@workos/authkit-astro';
 * export const GET = createCallbackHandler({
 *   errorRedirect: '/login',
 *   onSuccess: (_ctx, { authResponse }) => console.log('signed in', authResponse.user.id),
 * });
 * ```
 */
declare function createCallbackHandler(options?: CallbackHandlerOptions): APIRoute;
/**
 * Drop-in GET handler for the OAuth callback. Verifies the PKCE state, exchanges
 * the code, sets the session cookie, and redirects to the original destination.
 * @example `// src/pages/callback.ts` → `export { handleCallback as GET } from '@workos/authkit-astro';`
 */
declare const handleCallback: APIRoute;
/**
 * Build a sign-out GET handler with a custom post-sign-out destination. The
 * handler also honours a `?returnTo=` query param (relative paths only).
 *
 * @example
 * ```ts
 * // src/pages/logout.ts
 * import { createSignOutHandler } from '@workos/authkit-astro';
 * export const GET = createSignOutHandler({ afterSignOutUrl: '/goodbye' });
 * ```
 */
declare function createSignOutHandler(options?: SignOutHandlerOptions): APIRoute;
/**
 * Drop-in GET handler that clears the local session and redirects to the WorkOS
 * logout URL.
 * @example `// src/pages/logout.ts` → `export { handleSignOut as GET } from '@workos/authkit-astro';`
 */
declare const handleSignOut: APIRoute;
//#endregion
//#region src/webhooks.d.ts
/** Options for {@link verifyWebhook}. */
interface VerifyWebhookOptions {
  /** Webhook signing secret. Defaults to `WORKOS_WEBHOOK_SECRET`. */
  secret?: string;
  /** Maximum allowed age of the signature, in milliseconds. */
  tolerance?: number;
}
/**
 * Verify a WorkOS webhook request (the `workos-signature` header) and return
 * the parsed event. Throws when the signature is missing, stale, or invalid.
 *
 * @example
 * ```ts
 * // src/pages/api/webhooks.ts
 * import { verifyWebhook } from '@workos/authkit-astro';
 *
 * export const POST: APIRoute = async (context) => {
 *   const event = await verifyWebhook(context);
 *   if (event.event === 'user.created') { ... }
 *   return new Response(null, { status: 200 });
 * };
 * ```
 */
declare function verifyWebhook(context: Pick<APIContext, 'request'>, options?: VerifyWebhookOptions): Promise<Event>;
//#endregion
//#region src/index.d.ts
declare global {
  namespace App {
    interface Locals {
      auth: AuthKitAuth;
    }
  }
} //# sourceMappingURL=index.d.ts.map
//#endregion
export { type AuthCondition, type AuthKitAuth, type AuthKitConfig, type AuthKitMiddlewareHandler, type AuthkitIntegrationOptions, type AuthkitMiddlewareOptions, type CallbackHandlerOptions, type CallbackSuccess, type ClientAuth, type ClientUser, type HasCheckParams, type ProtectedRoutes, type RedirectToSignInOptions, type RouteMatcherInput, type SessionClaims, type SignInOptions, type SignOutHandlerOptions, type SignedInAuth, type SignedOutAuth, type VerifyWebhookOptions, authkitMiddleware, configureAuthKit, createCallbackHandler, createRouteMatcher, createSignOutHandler, authkit as default, getSignInUrl, getSignUpUrl, getWorkOS, handleCallback, handleSignIn, handleSignOut, handleSignUp, switchToOrganization, verifyWebhook };
//# sourceMappingURL=index.d.ts.map