@asgardeo/nuxt 0.0.0 → 0.1.0

package/dist/runtime/server/routes/auth/session/signin.get.js

@@ -0,0 +1,37 @@
+import { generateSessionId } from "@asgardeo/node";
+import { defineEventHandler, getQuery, sendRedirect, setCookie, createError } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { createTempSessionToken, getTempSessionCookieName, getTempSessionCookieOptions } from "../../../utils/session.js";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler(async (event) => {
+  const client = AsgardeoNuxtClient.getInstance();
+  const config = useRuntimeConfig();
+  const sessionSecret = config.asgardeo?.sessionSecret;
+  const query = getQuery(event);
+  const returnTo = query["returnTo"];
+  const safeReturnTo = returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//") ? returnTo : void 0;
+  const sessionId = generateSessionId();
+  const tempToken = await createTempSessionToken(sessionId, sessionSecret, safeReturnTo);
+  setCookie(event, getTempSessionCookieName(), tempToken, getTempSessionCookieOptions());
+  let authorizationUrl = null;
+  await client.signIn(
+    (url) => {
+      authorizationUrl = url;
+    },
+    sessionId,
+    void 0,
+    // no authorization code (initial redirect)
+    void 0,
+    // no session_state
+    void 0,
+    // no state
+    {}
+  );
+  if (!authorizationUrl) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Failed to generate authorization URL."
+    });
+  }
+  return sendRedirect(event, authorizationUrl, 302);
+});

package/dist/runtime/server/routes/auth/session/signin.post.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * POST /api/auth/signin
+ *
+ * Handles embedded (app-native) sign-in flow steps.
+ *
+ * Request body:
+ * - `payload` — the embedded flow step payload (`EmbeddedSignInFlowHandleRequestPayload`).
+ *   When omitted or `{}`, the flow is initialised and the authorize URL is returned.
+ * - `request` — optional per-step config (e.g. `{ url }` override).
+ *
+ * Response shape:
+ * ```json
+ * { "data": { ... }, "success": true }
+ * ```
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    data: unknown;
+    success: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/session/signin.post.js

@@ -0,0 +1,102 @@
+import { EmbeddedSignInFlowStatus, generateSessionId, isEmpty } from "@asgardeo/node";
+import { defineEventHandler, readBody, getCookie, setCookie, deleteCookie, createError } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { useServerSession } from "../../../utils/serverSession.js";
+import {
+  issueSessionCookie,
+  createTempSessionToken,
+  verifyTempSessionToken,
+  getTempSessionCookieName,
+  getTempSessionCookieOptions
+} from "../../../utils/session.js";
+import { useRuntimeConfig } from "#imports";
+function isTokenResponse(value) {
+  return typeof value === "object" && value !== null && ("accessToken" in value || "idToken" in value || "refreshToken" in value);
+}
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig();
+  const sessionSecret = config.asgardeo?.sessionSecret;
+  const afterSignInUrl = config.public.asgardeo?.afterSignInUrl || "/";
+  const client = AsgardeoNuxtClient.getInstance();
+  let sessionId;
+  const liveSession = await useServerSession(event);
+  if (liveSession?.sessionId) {
+    sessionId = liveSession.sessionId;
+  } else {
+    const tempCookie = getCookie(event, getTempSessionCookieName());
+    if (tempCookie) {
+      try {
+        const tempSession = await verifyTempSessionToken(
+          tempCookie,
+          sessionSecret
+        );
+        sessionId = tempSession.sessionId;
+      } catch {
+        sessionId = generateSessionId();
+      }
+    } else {
+      sessionId = generateSessionId();
+    }
+    const tempToken = await createTempSessionToken(sessionId, sessionSecret);
+    setCookie(event, getTempSessionCookieName(), tempToken, getTempSessionCookieOptions());
+  }
+  const body = await readBody(event);
+  const payload = body?.payload ?? {};
+  const request = body?.request ?? {};
+  if (isEmpty(payload) || !("flowId" in payload)) {
+    try {
+      const signInUrl = await client.getAuthorizeRequestUrl(
+        { client_secret: "{{clientSecret}}", response_mode: "direct" },
+        sessionId
+      );
+      return { data: { signInUrl }, success: true };
+    } catch (err) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: `Failed to build authorize URL: ${err?.message ?? String(err)}`
+      });
+    }
+  }
+  let response;
+  try {
+    response = await client.signIn(payload, request, sessionId);
+  } catch (err) {
+    throw createError({
+      statusCode: 502,
+      statusMessage: `Embedded sign-in step failed: ${err?.message ?? String(err)}`
+    });
+  }
+  if (response?.flowStatus === EmbeddedSignInFlowStatus.SuccessCompleted) {
+    const authData = response?.authData ?? {};
+    const { code, state, session_state: sessionState } = authData;
+    if (!code) {
+      throw createError({ statusCode: 502, statusMessage: "Authorization code missing from completed flow response." });
+    }
+    let tokenResponse;
+    try {
+      tokenResponse = await client.signIn({ code, session_state: sessionState, state }, {}, sessionId);
+    } catch (err) {
+      throw createError({
+        statusCode: 502,
+        statusMessage: `Token exchange failed after embedded flow: ${err?.message ?? String(err)}`
+      });
+    }
+    if (!isTokenResponse(tokenResponse)) {
+      throw createError({
+        statusCode: 502,
+        statusMessage: "Token exchange failed: Invalid token response from Identity Provider."
+      });
+    }
+    try {
+      await issueSessionCookie(event, sessionId, tokenResponse, sessionSecret);
+      deleteCookie(event, getTempSessionCookieName(), getTempSessionCookieOptions());
+    } catch (err) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: `Failed to establish session: ${err?.message ?? String(err)}`
+      });
+    }
+    return { data: { afterSignInUrl }, success: true };
+  }
+  return { data: response, success: true };
+});

package/dist/runtime/server/routes/auth/session/signout.post.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * POST /api/auth/signout
+ *
+ * Signs the user out by:
+ * 1. Getting the sign-out URL from Asgardeo (for RP-Initiated Logout)
+ * 2. Clearing all session cookies
+ * 3. Returning `{ redirectUrl }` for the client to navigate to
+ *
+ * Using POST instead of GET prevents CSRF-based forced sign-outs.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    redirectUrl: string;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/session/signout.post.js

@@ -0,0 +1,38 @@
+import { defineEventHandler, deleteCookie } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { verifyAndRehydrateSession } from "../../../utils/serverSession.js";
+import {
+  getSessionCookieName,
+  getSessionCookieOptions,
+  getTempSessionCookieName,
+  getTempSessionCookieOptions
+} from "../../../utils/session.js";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig();
+  const sessionSecret = config.asgardeo?.sessionSecret;
+  const publicConfig = config.public.asgardeo;
+  const fallbackUrl = publicConfig.afterSignOutUrl || "/";
+  const clearCookies = () => {
+    deleteCookie(event, getSessionCookieName(), getSessionCookieOptions());
+    deleteCookie(event, getTempSessionCookieName(), getTempSessionCookieOptions());
+  };
+  const session = await verifyAndRehydrateSession(
+    event,
+    sessionSecret
+  );
+  if (!session) {
+    clearCookies();
+    return { redirectUrl: fallbackUrl };
+  }
+  try {
+    const client = AsgardeoNuxtClient.getInstance();
+    const signOutUrl = await client.signOut(session.sessionId);
+    clearCookies();
+    return { redirectUrl: signOutUrl || fallbackUrl };
+  } catch (err) {
+    console.error("[asgardeo] Sign-out error:", err?.message || err);
+    clearCookies();
+    return { redirectUrl: fallbackUrl };
+  }
+});

package/dist/runtime/server/routes/auth/session/signup.post.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * POST /api/auth/signup
+ *
+ * Handles embedded (app-native) sign-up flow steps.
+ *
+ * Request body:
+ * - `payload` — the embedded sign-up flow step payload (`EmbeddedFlowExecuteRequestPayload`).
+ *   When omitted, returns an empty `signUpUrl` (caller should redirect to the sign-up page).
+ *
+ * Response shape:
+ * ```json
+ * { "data": { ... }, "success": true }
+ * ```
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    data: unknown;
+    success: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/session/signup.post.js

@@ -0,0 +1,30 @@
+import { EmbeddedFlowStatus } from "@asgardeo/node";
+import { defineEventHandler, readBody, createError } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { useRuntimeConfig } from "#imports";
+function hasFlowStatus(value) {
+  return typeof value === "object" && value !== null && "flowStatus" in value;
+}
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig();
+  const afterSignUpUrl = config.public.asgardeo?.afterSignInUrl || "/";
+  const body = await readBody(event);
+  const payload = body?.payload;
+  if (!payload) {
+    return { data: { signUpUrl: "" }, success: true };
+  }
+  const client = AsgardeoNuxtClient.getInstance();
+  let response;
+  try {
+    response = await client.signUp(payload);
+  } catch (err) {
+    throw createError({
+      statusCode: 502,
+      statusMessage: `Embedded sign-up step failed: ${err?.message ?? String(err)}`
+    });
+  }
+  if (hasFlowStatus(response) && response.flowStatus === EmbeddedFlowStatus.Complete) {
+    return { data: { afterSignUpUrl }, success: true };
+  }
+  return { data: response, success: true };
+});

package/dist/runtime/server/routes/auth/session/token.get.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * GET /api/auth/token
+ *
+ * Returns a valid access token for the current session.
+ * Proactively refreshes the token if it is within 60 seconds of expiry
+ * (requires a refresh token stored in the session JWT).
+ * Returns 401 if there is no active session or the token cannot be refreshed.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    accessToken: string;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/session/token.get.js

@@ -0,0 +1,6 @@
+import { defineEventHandler } from "h3";
+import { getValidAccessToken } from "../../../utils/token-refresh.js";
+export default defineEventHandler(async (event) => {
+  const accessToken = await getValidAccessToken(event);
+  return { accessToken };
+});

package/dist/runtime/server/routes/auth/user/profile.get.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { UserProfile } from '@asgardeo/node';
+/**
+ * GET /api/auth/user/profile
+ *
+ * Returns the full SCIM2 {@link UserProfile} (with `flattenedProfile` and
+ * `schemas`) for the authenticated user.  Used by `AsgardeoRoot.revalidateProfile`
+ * to refresh client-side state after a profile update.
+ *
+ * Mirrors `getUserProfileAction` in the Next.js SDK.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserProfile>>;
+export default _default;

package/dist/runtime/server/routes/auth/user/profile.get.js

@@ -0,0 +1,24 @@
+import { defineEventHandler, createError } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { verifyAndRehydrateSession } from "../../../utils/serverSession.js";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig();
+  const sessionSecret = config.asgardeo?.sessionSecret;
+  const session = await verifyAndRehydrateSession(
+    event,
+    sessionSecret
+  );
+  if (!session) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized: Invalid or expired session." });
+  }
+  try {
+    const client = AsgardeoNuxtClient.getInstance();
+    return await client.getUserProfile(session.sessionId);
+  } catch (err) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: `Failed to retrieve user profile: ${err instanceof Error ? err.message : String(err)}`
+    });
+  }
+});

package/dist/runtime/server/{handler.d.ts → routes/auth/user/profile.patch.d.ts}

@@ -15,17 +15,21 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { type AuthClientConfig } from '@asgardeo/auth-node';
-import type { CookieSerializeOptions } from 'cookie-es';
-export interface AsgardeoAuthHandlerOptions {
-    basePath?: string;
-    cookies?: {
-        defaultOptions?: CookieSerializeOptions;
-        sessionId?: string;
-        sessionIdOptions?: CookieSerializeOptions;
-        state?: string;
-        stateOptions?: CookieSerializeOptions;
+import type { User } from '@asgardeo/node';
+/**
+ * PATCH /api/auth/user/profile
+ *
+ * Updates the SCIM2 /Me profile for the authenticated user.
+ * Mirrors the `updateUserProfileAction` Next.js server action.
+ *
+ * Request body: {@link UpdateMeProfileConfig} (the SCIM patch payload).
+ * Response: `{ data: { user: User }; success: boolean; error: string }`
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    data: {
+        user: User;
     };
-    defaultCallbackUrl?: string;
-}
-export declare const AsgardeoAuthHandler: (config: AuthClientConfig, options?: AsgardeoAuthHandlerOptions) => any;
+    error: string;
+    success: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/user/profile.patch.js

@@ -0,0 +1,33 @@
+import { defineEventHandler, readBody, createError } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { verifyAndRehydrateSession } from "../../../utils/serverSession.js";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler(
+  async (event) => {
+    const config = useRuntimeConfig();
+    const sessionSecret = config.asgardeo?.sessionSecret;
+    const session = await verifyAndRehydrateSession(
+      event,
+      sessionSecret
+    );
+    if (!session) {
+      throw createError({ statusCode: 401, statusMessage: "Unauthorized: Invalid or expired session." });
+    }
+    let payload;
+    try {
+      payload = await readBody(event);
+    } catch {
+      throw createError({ statusCode: 400, statusMessage: "Invalid request body." });
+    }
+    try {
+      const client = AsgardeoNuxtClient.getInstance();
+      const user = await client.updateUserProfile(payload, session.sessionId);
+      return { data: { user }, error: "", success: true };
+    } catch (err) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: `Failed to update user profile: ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  }
+);

package/dist/runtime/server/{services/asgardeo/index.d.ts → routes/auth/user/user.get.d.ts}

@@ -15,9 +15,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { AsgardeoNodeClient, type AuthClientConfig } from '@asgardeo/auth-node';
 /**
- * Returns a singleton AsgardeoNodeClient instance.
- * Must be called with configuration on first call.
+ * GET /api/auth/user
+ *
+ * Returns user information for the current session.
+ * Requires a valid session.
  */
-export declare function getAsgardeoSdkInstance(config: AuthClientConfig): AsgardeoNodeClient<any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<import("@asgardeo/javascript").User>>;
+export default _default;

package/dist/runtime/server/routes/auth/user/user.get.js

@@ -0,0 +1,21 @@
+import { defineEventHandler, createError } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { verifyAndRehydrateSession } from "../../../utils/serverSession.js";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig();
+  const sessionSecret = config.asgardeo?.sessionSecret;
+  const session = await verifyAndRehydrateSession(
+    event,
+    sessionSecret
+  );
+  if (!session) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized: Invalid or expired session." });
+  }
+  try {
+    const client = AsgardeoNuxtClient.getInstance();
+    return await client.getUser(session.sessionId);
+  } catch {
+    throw createError({ statusCode: 500, statusMessage: "Failed to retrieve user information." });
+  }
+});

package/dist/runtime/server/utils/event-context.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { H3Event } from 'h3';
+import type { AsgardeoSessionPayload, AsgardeoSSRData } from '../../types.js';
+/**
+ * The typed shape of `event.context.asgardeo` set by the Asgardeo Nitro plugin
+ * on every SSR request.
+ */
+export interface AsgardeoEventContext {
+    /** Convenience boolean derived from the session presence. */
+    isSignedIn: boolean;
+    /** The decoded session payload, or null when the user is not signed in. */
+    session: AsgardeoSessionPayload | null;
+    /** SSR-prefetched data (user profile, orgs, branding). Present only after the SSR plugin runs. */
+    ssr?: AsgardeoSSRData;
+}
+/**
+ * Typed accessor for `event.context.asgardeo`.
+ *
+ * Returns null when called before the Asgardeo SSR plugin has populated
+ * the context (e.g. in non-Nuxt Nitro routes that run before the plugin).
+ *
+ * @example
+ * ```ts
+ * import { getAsgardeoContext } from '@asgardeo/nuxt/server';
+ *
+ * export default defineEventHandler((event) => {
+ *   const ctx = getAsgardeoContext(event);
+ *   if (!ctx?.isSignedIn) throw createError({ statusCode: 401 });
+ *   return { userId: ctx.session!.sub };
+ * });
+ * ```
+ */
+export declare function getAsgardeoContext(event: H3Event): AsgardeoEventContext | null;

package/dist/runtime/server/utils/event-context.js

@@ -0,0 +1,3 @@
+export function getAsgardeoContext(event) {
+  return event.context.asgardeo ?? null;
+}

package/dist/runtime/server/utils/serverSession.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { H3Event } from 'h3';
+import type { AsgardeoSessionPayload } from '../../types.js';
+/**
+ * Get the current session from the request cookie.
+ * Returns the session payload if valid, or null if no session exists.
+ *
+ * Use this in custom server API routes to access session data.
+ *
+ * @example
+ * ```ts
+ * // server/api/me.get.ts
+ * export default defineEventHandler(async (event) => {
+ *   const session = await useServerSession(event);
+ *   if (!session) {
+ *     throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
+ *   }
+ *   return { sessionId: session.sessionId, sub: session.sub };
+ * });
+ * ```
+ */
+export declare function useServerSession(event: H3Event): Promise<AsgardeoSessionPayload | null>;
+/**
+ * Get the current session or throw a 401 error.
+ * Use this when the route must be authenticated.
+ *
+ * @example
+ * ```ts
+ * // server/api/protected-data.get.ts
+ * export default defineEventHandler(async (event) => {
+ *   const session = await requireServerSession(event);
+ *   // session is guaranteed to be non-null here
+ *   return { userId: session.sub };
+ * });
+ * ```
+ */
+export declare function requireServerSession(event: H3Event): Promise<AsgardeoSessionPayload>;
+/**
+ * Verify the session cookie and rehydrate the legacy in-memory token store
+ * from its payload. Used internally by the SDK's SSR plugin and /api/auth/*
+ * routes so that subsequent calls which look up tokens by `sessionId`
+ * (`getAccessToken`, `getUser`, `getDecodedIdToken`, `signOut`) still succeed
+ * after a server restart, when the in-memory store is empty but the signed
+ * session cookie is still valid.
+ *
+ * Returns `null` for missing or invalid cookies — callers decide whether to
+ * 401 or silently treat the user as unauthenticated.
+ */
+export declare function verifyAndRehydrateSession(event: H3Event, sessionSecret?: string): Promise<AsgardeoSessionPayload | null>;