/**
 * SSO auth domain types: session, flow steps, adapter contracts, and error codes.
 * Used by the flow engine, provider, and adapter implementations.
 */
/** Auth methods available in the SSO system. */
export type AuthMethod = 'phone' | 'email' | 'google' | 'apple';
/** User payload in the SSO session. */
export interface SSOUser {
    id: string;
    name: string;
    email?: string;
    phone?: string;
    avatar?: string;
    isNewUser: boolean;
}
/** The SSO session — same structure regardless of auth method used. */
export interface SSOSession {
    accessToken: string;
    refreshToken?: string;
    expiresAt: number;
    user: SSOUser;
    authMethod: AuthMethod;
}
/** User type for layout and OTP routing: Indian (+91) vs Foreign (non +91). */
export type UserType = 'INDIAN' | 'FOREIGN';
/** Flow states for the state machine. */
export type AuthStep = 'CHECKING_SESSION' | 'REPEAT_LOGIN' | 'METHOD_SELECT' | 'PHONE_ENTRY' | 'EMAIL_ENTRY' | 'OTP_VERIFICATION' | 'SIGNUP_DETAILS' | 'LINK_OR_MERGE' | 'PROVIDER_PENDING' | 'AUTHENTICATED';
/** Error codes from the central auth service. */
export type AuthErrorCode = 'IDENTIFIER_CONFLICT' | 'OTP_EXPIRED' | 'OTP_INVALID' | 'OTP_RATE_LIMIT' | 'SESSION_EXPIRED' | 'PROVIDER_AUTH_FAILED' | 'NETWORK_ERROR' | 'UNKNOWN';
/** Auth error with code and optional message / linked identifier. */
export interface AuthError {
    code: AuthErrorCode;
    message?: string;
    /** Masked linked identifier when conflict (e.g. "+91 98XXXX0X0X"). */
    linkedIdentifier?: string;
}
/** Response from sendOtp. */
export interface SendOtpResponse {
    success: boolean;
    /** Masked value for display (e.g. "+91 9825910X0X" or "j***@gmail.com"). */
    maskedValue?: string;
    error?: AuthError;
}
/** Result of verifyOtp or authenticateWithProvider: existing user gets session, new user gets profile step. */
export interface VerifyOtpResponse {
    /** Present when user exists and is authenticated. */
    session?: SSOSession;
    /** True when user is new and must complete profile. */
    isNewUser: boolean;
    /** When isNewUser and conflict (e.g. email already linked), masked linked identifier. */
    conflict?: AuthError;
}
/** Input for completeProfile (new users). */
export interface CompleteProfileParams {
    fullName: string;
    email?: string;
    phone?: string;
}
/** Input for authenticateWithProvider (Google/Apple credential). */
export interface AuthenticateWithProviderParams {
    provider: 'google' | 'apple';
    /** Id token or equivalent from the provider. */
    credential: string;
}
/** Repeat-login device history (method + masked identifier). */
export interface RepeatLoginInfo {
    method: AuthMethod;
    maskedIdentifier: string;
    timestamp: number;
}
