import { AuthenticationResponse, BaseTokenClaims, CustomClaims, Impersonator, User } from "@workos/authkit-session";
import { APIContext, MiddlewareNext } from "astro";

//#region src/types.d.ts
/** The minimal context shape the URL helpers need — satisfied by both an
 *  endpoint's `APIContext` and the `Astro` global in `.astro` files. */
type CookieContext = Pick<APIContext, 'cookies'>;
/** Context shape for {@link switchToOrganization} — `Astro` or an `APIContext`. */
type SessionContext = Pick<APIContext, 'cookies' | 'url' | 'redirect' | 'locals'>;
/**
 * Configuration for the AuthKit Astro integration. Mirrors the cookie-related
 * options of `@workos/authkit-session`.
 */
interface AuthKitConfig {
  /** WorkOS Client ID. */
  clientId: string;
  /** WorkOS API Key. */
  apiKey: string;
  /** OAuth redirect URI (must match the WorkOS dashboard). */
  redirectUri: string;
  /** Cookie encryption password (min 32 chars). */
  cookiePassword: string;
  /** Custom session cookie name (default: `wos-session`). */
  cookieName?: string;
  /** Cookie domain restriction. */
  cookieDomain?: string;
  /** Cookie max age in seconds (default: 400 days). */
  cookieMaxAge?: number;
}
/**
 * Access checks accepted by `auth.has()`. Every provided condition must pass
 * (logical AND); `has()` always returns `false` when signed out.
 */
interface HasCheckParams {
  /** Matches `auth.role` or membership in `auth.roles`. */
  role?: string;
  permission?: string;
  entitlement?: string;
  featureFlag?: string;
}
/** Options for `auth.redirectToSignIn()`. */
interface RedirectToSignInOptions {
  /** Where to land after authentication (defaults to the current URL). */
  returnTo?: string;
}
/** JWT claims for the active session (standard + WorkOS + custom claims). */
type SessionClaims = BaseTokenClaims & CustomClaims;
interface AuthKitAuthBase {
  entitlements: string[];
  featureFlags: string[];
  /** Role / permission / entitlement / feature-flag check. `false` when signed out. */
  has(params: HasCheckParams): boolean;
  /**
   * Build a redirect `Response` to the sign-in page, preserving the current
   * URL as `returnTo`. Return it from a page or endpoint:
   * `if (!auth.user) return auth.redirectToSignIn();`
   */
  redirectToSignIn(options?: RedirectToSignInOptions): Response;
}
/** `Astro.locals.auth` when a user is signed in. */
interface SignedInAuth extends AuthKitAuthBase {
  user: User;
  sessionId: string;
  accessToken: string;
  /** Verified claims from the access token (including custom claims). */
  claims: SessionClaims;
  organizationId: string | null;
  role: string | null;
  roles: string[];
  permissions: string[];
  impersonator: Impersonator | null;
}
/** `Astro.locals.auth` when no user is signed in. */
interface SignedOutAuth extends AuthKitAuthBase {
  user: null;
  sessionId?: undefined;
  accessToken?: undefined;
  claims: null;
  organizationId: null;
  role: null;
  roles: string[];
  permissions: string[];
  impersonator: null;
}
/**
 * Authentication state exposed on `Astro.locals.auth`. A discriminated union
 * on `user` — checking `if (auth.user)` narrows `sessionId`, `accessToken`,
 * and `claims` to their signed-in (non-optional) types.
 */
type AuthKitAuth = SignedInAuth | SignedOutAuth;
/** Sign-in / sign-up URL options. */
interface SignInOptions {
  /** Path to return to after authentication. */
  returnTo?: string;
  /** Pre-select an organization. */
  organizationId?: string;
  /** Pre-fill the email address. */
  loginHint?: string;
}
/**
 * Which routes require authentication: a list of patterns (plain-string path
 * prefixes, `path-to-regexp` 6.x strings like `/dashboard(.*)` or
 * `/orgs/:slug`, or RegExps) or a predicate over the pathname.
 */
type ProtectedRoutes = (string | RegExp)[] | ((pathname: string) => boolean);
/** Options for {@link authkitMiddleware}. */
interface AuthkitMiddlewareOptions {
  /** Routes that require a signed-in user; anonymous visitors are redirected. */
  protectedRoutes?: ProtectedRoutes;
  /** Where to send unauthenticated visitors of protected routes (default `/login`). */
  signInPath?: string;
  /** Log per-request diagnostics. */
  debug?: boolean;
  /** Called when session validation throws. */
  onError?: (error: Error) => void;
  /** Runtime configuration (overrides environment variables). */
  config?: AuthKitConfig;
}
/**
 * Custom middleware handler for full per-request control:
 * `authkitMiddleware((auth, context, next) => { ... })`.
 *
 * Runs after `locals.auth` is populated (and after the `protectedRoutes`
 * gate, when one is configured). Return a `Response` to short-circuit, or
 * nothing to continue to the route.
 */
type AuthKitMiddlewareHandler = (auth: AuthKitAuth, context: APIContext, next: MiddlewareNext) => Promise<Response | void> | Response | void;
/** Options for {@link createSignOutHandler}. */
interface SignOutHandlerOptions {
  /** Post-sign-out destination (default `/`). A `?returnTo=` query param overrides it. */
  afterSignOutUrl?: string;
}
/** The success payload passed to a callback handler's `onSuccess`. */
interface CallbackSuccess {
  /** Where the user is about to be redirected. */
  returnPathname: string;
  /** The full WorkOS authentication response (user, tokens, etc.). */
  authResponse: AuthenticationResponse;
}
/** Options for {@link createCallbackHandler}. */
interface CallbackHandlerOptions {
  /**
   * On failure, redirect here (with `?error=` and `?error_description=`
   * appended) instead of returning a 400 response.
   */
  errorRedirect?: string;
  /**
   * Called after a successful code exchange, before the redirect. Return a
   * `Response` to take over entirely, a string to redirect elsewhere, or
   * nothing to keep the default redirect.
   */
  onSuccess?: (context: APIContext, result: CallbackSuccess) => Promise<Response | string | void> | Response | string | void;
  /**
   * Called when the callback fails. Return a `Response` to take over;
   * otherwise the `errorRedirect` / 400 behaviour applies.
   */
  onError?: (context: APIContext, error: Error) => Promise<Response | void> | Response | void;
}
//#endregion
//#region src/shared.d.ts
/**
 * The client-safe subset of the session. Crucially this **omits the access
 * token** — never ship `accessToken` to the browser.
 */
interface ClientAuth {
  user: User | null;
  sessionId: string | null;
  organizationId: string | null;
  role: string | null;
  roles: string[];
  permissions: string[];
  entitlements: string[];
  featureFlags: string[];
  impersonator: Impersonator | null;
}
type ClientUser = User;
declare function emptyClientAuth(): ClientAuth;
/**
 * Project the server-side `AuthKitAuth` down to the client-safe `ClientAuth`.
 * The access token is intentionally dropped here.
 */
declare function toClientAuth(auth: AuthKitAuth | undefined): ClientAuth;
/**
 * A declarative auth condition — accepted by the `<Show when={...}>` component
 * and serialized into `<authkit-gate data-when>` for the client-side fallback
 * on prerendered pages.
 */
type AuthCondition = 'signed-in' | 'signed-out' | {
  role?: string;
  permission?: string;
  entitlement?: string;
  featureFlag?: string;
} | {
  not: AuthCondition;
};
/** The minimal auth shape a condition can be evaluated against — both the
 *  server-side `AuthKitAuth` and the client `ClientAuth` satisfy it. */
interface AuthConditionSubject {
  user: unknown;
  role?: string | null;
  roles?: string[];
  permissions?: string[];
  entitlements?: string[];
  featureFlags?: string[];
}
/**
 * Evaluate an {@link AuthCondition}. Object conditions AND their checks and
 * are always `false` when signed out; `{ not: ... }` negates.
 */
declare function checkAuthCondition(auth: AuthConditionSubject, condition: AuthCondition): boolean;
//#endregion
export { SignedOutAuth as C, SignedInAuth as S, RedirectToSignInOptions as _, checkAuthCondition as a, SignInOptions as b, AuthKitAuth as c, AuthkitMiddlewareOptions as d, CallbackHandlerOptions as f, ProtectedRoutes as g, HasCheckParams as h, ClientUser as i, AuthKitConfig as l, CookieContext as m, AuthConditionSubject as n, emptyClientAuth as o, CallbackSuccess as p, ClientAuth as r, toClientAuth as s, AuthCondition as t, AuthKitMiddlewareHandler as u, SessionClaims as v, SignOutHandlerOptions as x, SessionContext as y };
//# sourceMappingURL=shared-CWMH5N-C.d.ts.map