import { T as TangleIdentityOptions, b as TangleIdentityClient, c as TangleTokenVerifyFailure } from '../tangle-id-BMScmNjp.js';
import '../types-eAvAgnKr.js';

/**
 * @stable Drop-in request middleware that verifies id.tangle.tools
 * credentials and attaches `{ userId, workspaceId, scopes, kind }` to the
 * request.
 *
 * The middleware is framework-agnostic. Instead of binding to express /
 * hono / itty-router specifically (each has its own request typings and
 * lifecycle), the helper accepts either a `Request` (web standard) or a
 * `{ headers }`-shaped object and returns a typed result the caller wires
 * into its own context. Concrete adapters for hono / express / fetch live
 * one call below in the same module so a product can pick the shape it
 * uses without dragging in framework types from the rest.
 *
 * Why this matters: legal-agent runs on Bun + Hono. tax-agent runs on
 * CF Workers + itty-router. gtm-agent runs on Node + Express. Wiring an
 * identical "is this caller authed" check across all three is what
 * unblocks shipping product apps in parallel.
 *
 * Token sources (checked in order):
 *
 *   1. `Authorization: Bearer <token>` — handles both sk-tan-* API keys
 *      and Better Auth-issued session bearers.
 *   2. `Cookie: better-auth.session_token=<jwt>` — the canonical browser
 *      flow. We forward the cookie value as a Bearer to the platform's
 *      `/api/auth/get-session` endpoint.
 *
 * On success the middleware returns:
 *
 *   { ok: true, auth: { userId, workspaceId, scopes, kind, expiresAt? } }
 *
 * On failure:
 *
 *   { ok: false, status: 401|403, reason: '<stable-code>' }
 *
 * The caller decides whether to short-circuit the request (production) or
 * downgrade to anonymous (read-only public endpoints). The middleware
 * NEVER throws on bad-token; only true platform unreachability bubbles up
 * as a `TangleIdentityUnreachableError`.
 */

/** Auth context the middleware attaches to the request on success. */
interface TangleAuthContext {
    userId: string;
    workspaceId: string;
    scopes: string[];
    kind: 'api_key' | 'session';
    /** Wall-clock ms epoch when the credential expires, when known. */
    expiresAt?: number;
    /** Stable credential id (key id for API keys, session id for sessions). */
    credentialId?: string;
    /** Owner-shape on the platform side. */
    ownerType: 'user' | 'team';
    /** Product the credential is scoped to, when known. */
    product?: string;
}
type TangleAuthOutcome = {
    ok: true;
    auth: TangleAuthContext;
} | {
    ok: false;
    status: 401 | 403 | 503;
    reason: TangleAuthReason;
};
/** Stable failure reasons surfaced to the caller. */
type TangleAuthReason = 'missing_credential' | 'malformed_credential' | 'service_token_refused' | TangleTokenVerifyFailure | 'platform_unreachable';
interface RequireTangleAuthOptions extends TangleIdentityOptions {
    /** Pre-built client. When supplied, all `TangleIdentityOptions` fields
     *  are ignored. Tests pass a stub here; production code typically
     *  constructs the client once at boot and passes it in. */
    client?: TangleIdentityClient;
    /** Override the cookie name where the session bearer lives. Defaults
     *  to `better-auth.session_token` — matches the platform's Better Auth
     *  configuration. */
    sessionCookieName?: string;
    /** If true, missing-credential returns `ok: false, status: 401`
     *  (default). If false, the middleware returns `ok: true` with a
     *  synthetic anonymous context — useful for public endpoints that want
     *  to opportunistically hydrate identity. */
    requireCredential?: boolean;
}
/**
 * Verify the credential on `request` against id.tangle.tools and resolve
 * to a typed {@link TangleAuthContext}. Request type is the web-standard
 * `Request` shape — works in Bun, Workers, Deno, Node 20+, Hono context's
 * `c.req.raw`, and Express adapters that surface `req` via `webRequest()`.
 */
declare function requireTangleAuth(request: Pick<Request, 'headers'>, opts?: RequireTangleAuthOptions): Promise<TangleAuthOutcome>;
/**
 * Extract the bearer credential from a request. Public so callers that
 * want to reuse the same token-discovery logic outside the middleware
 * (e.g. to attribute audit log entries) don't have to re-implement it.
 *
 * Order: Authorization header first (canonical), session cookie second.
 * Service tokens (`svc_*`) are explicitly dropped — the platform's
 * middleware refuses to map them to a user, so accepting them here
 * would invite the exact "service-as-user" privilege escalation the
 * platform's `resolveServiceIdentity` already guards against.
 */
declare function extractToken(request: Pick<Request, 'headers'>, sessionCookieName?: string): string | undefined;
/**
 * Hono-flavored convenience wrapper. Returns a hono middleware factory
 * that calls {@link requireTangleAuth} and stashes the result on the
 * Hono context under `c.set('tangleAuth', auth)`. On failure short-
 * circuits with the canonical {success:false} envelope the platform uses.
 *
 * Kept typed against a structural `Context`-like shape so this module
 * does NOT take a hono peerDep. Consumers pass `c` directly.
 */
declare function honoTangleAuthMiddleware(opts?: RequireTangleAuthOptions): (c: HonoLikeContext, next: () => Promise<void>) => Promise<Response | void>;
/** Minimal Hono Context-shaped surface. Avoids the hono peerDep. */
interface HonoLikeContext {
    req: {
        raw: Request;
    };
    set(key: 'tangleAuth', value: TangleAuthContext): void;
}
/**
 * Express-flavored convenience wrapper. Same outcome shape as the Hono
 * helper, expressed via the Node `req` / `res` / `next` triple. Consumers
 * pass the triple as positional args. Returns a function compatible with
 * any express-like `app.use(fn)`.
 */
declare function expressTangleAuthMiddleware(opts?: RequireTangleAuthOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse, next: (err?: unknown) => void) => Promise<void>;
/** Minimal Express-shaped surfaces. Avoids the express peerDep. */
interface ExpressLikeRequest {
    headers: Record<string, string | string[] | undefined>;
    tangleAuth?: TangleAuthContext;
}
interface ExpressLikeResponse {
    status(code: number): unknown;
    setHeader?(name: string, value: string): unknown;
    end(body: string): unknown;
}

export { type ExpressLikeRequest, type ExpressLikeResponse, type HonoLikeContext, type RequireTangleAuthOptions, type TangleAuthContext, type TangleAuthOutcome, type TangleAuthReason, expressTangleAuthMiddleware, extractToken, honoTangleAuthMiddleware, requireTangleAuth };
