import { AthenaError } from '@xylex-group/athena';
import { AthenaErrorUi } from './errors.js';
import { AuthUserView } from './user.js';
/**
 * Stable presentation model for an authenticated session.
 * Safe for React components — never includes access/refresh/session secrets.
 */
export interface AuthSessionView {
    activeOrganizationId: string | null;
    expiresAt: string;
    user: AuthUserView;
}
/**
 * Display-safe session alias. Prefer this (or {@link AuthSessionView}) in UI props.
 */
export type SessionPublicView = AuthSessionView;
/**
 * Token-bearing response for client transport only.
 * Never pass this into presentational components.
 */
export interface SessionTokenResponse {
    accessToken?: string;
    refreshToken?: string;
    sessionToken?: string;
}
/**
 * Admin / security-settings session row for list UIs.
 * Tokens are never part of this view; revoke uses a separate client DTO.
 */
export interface AdminSessionView {
    expiresAt: string;
    id: string;
    ipAddress: string | null;
    isCurrent: boolean;
    userAgent: string | null;
}
/**
 * Client-only input for revoking a device session.
 * Not for rendering.
 */
export interface SessionRevokeRequest {
    sessionToken: string;
}
/**
 * Public session view projected into SessionUiState.
 * Never includes access/refresh/session tokens.
 */
export interface SessionUiSession {
    activeOrganizationId?: string | null;
    expiresAt?: string;
    id?: string;
}
/**
 * Public organization slice on an authenticated SessionUiState.
 */
export interface SessionUiOrganization {
    activeId: string | null;
}
/**
 * Public authenticated user projected into SessionUiState.
 * Known identity fields plus plugin/custom profile attributes.
 * Never includes access/refresh/session tokens.
 */
export type SessionUiUser = Pick<AuthUserView, "id"> & Partial<Pick<AuthUserView, "email" | "emailVerified" | "imageUrl" | "name">> & Record<string, unknown>;
/**
 * Compat booleans derived from `status` (ADR 0022 / 0042).
 * Discriminator remains `status`.
 */
export interface SessionUiCompatFields {
    isAuthenticated?: boolean;
    isPending?: boolean;
}
/**
 * Discriminated public session contract for Auth UI.
 * Switch on `status` — do not combine `isPending && !session`.
 */
export type SessionUiState = ({
    status: "loading";
} & SessionUiCompatFields) | ({
    organization?: SessionUiOrganization | null;
    session: SessionUiSession;
    status: "authenticated";
    user: SessionUiUser;
} & SessionUiCompatFields) | ({
    status: "unauthenticated";
} & SessionUiCompatFields) | ({
    status: "unavailable";
} & SessionUiCompatFields) | ({
    error: AthenaError | AthenaErrorUi;
    status: "error";
} & SessionUiCompatFields);