@c1m-public/platform-auth 0.9.0 → 0.9.1

package/dist/access/next.js

@@ -1,12 +1,342 @@
-import { decodeTokenPayload } from '../chunk-FBC2NUH7.js';
-import { AccessSnapshotError, fetchAccessSnapshot, isAccessSnapshotError, hasAnyPermission, hasAllPermissions, hasWorkspacePermission } from '../chunk-U67NBJND.js';
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PIPELINE_STAGES, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-U67NBJND.js';
-import { resolveValue } from '../chunk-ZWSJVE5S.js';
 import 'server-only';
 import { cache } from 'react';
 import { forbidden, unauthorized } from 'next/navigation.js';
 import { updateTag } from 'next/cache.js';
 
+// src/access/next.ts
+
+// src/internal.ts
+function resolveValue(value) {
+  return typeof value === "function" ? value() : value;
+}
+async function timedFetch(url, options = {}) {
+  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const controller = options.timeoutMs ? new AbortController() : void 0;
+  const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
+  try {
+    return await doFetch(url, {
+      ...options.init,
+      cache: "no-store",
+      ...controller ? { signal: controller.signal } : {}
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+// src/token.ts
+function decodeBase64Url(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  try {
+    const binary = globalThis.atob(padded);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+  } catch {
+    return null;
+  }
+}
+function decodeTokenPayload(token) {
+  const payloadSegment = token.split(".")[1];
+  if (!payloadSegment) return null;
+  const decodedJson = decodeBase64Url(payloadSegment);
+  if (!decodedJson) return null;
+  try {
+    const parsed = JSON.parse(decodedJson);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/access/errors.ts
+var AccessSnapshotError = class extends Error {
+  code;
+  status;
+  constructor(code, message, status) {
+    super(message);
+    this.name = "AccessSnapshotError";
+    this.code = code;
+    this.status = status;
+  }
+};
+function isAccessSnapshotError(error, code) {
+  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
+}
+
+// ../transport/src/forwarding.ts
+function applyForwardedClientHeaders(incoming, headers = new Headers()) {
+  const forwardedFor = incoming.get("x-forwarded-for");
+  const realIp = incoming.get("x-real-ip") ?? forwardedFor?.split(",")[0]?.trim();
+  if (realIp && !headers.has("X-Client-IP")) headers.set("X-Client-IP", realIp);
+  if (realIp && !headers.has("X-Real-IP")) headers.set("X-Real-IP", realIp);
+  if (forwardedFor && !headers.has("X-Forwarded-For")) headers.set("X-Forwarded-For", forwardedFor);
+  const country = incoming.get("cf-ipcountry") ?? incoming.get("x-vercel-ip-country") ?? incoming.get("x-geo-country") ?? incoming.get("x-country-code");
+  if (country && country !== "XX" && !headers.has("X-Geo-Country")) {
+    headers.set("X-Geo-Country", country);
+  }
+  const host = incoming.get("host");
+  if (host && !headers.has("X-Forwarded-Host")) headers.set("X-Forwarded-Host", host);
+  const proto = incoming.get("x-forwarded-proto");
+  if (proto && !headers.has("X-Forwarded-Proto")) headers.set("X-Forwarded-Proto", proto);
+  const userAgent = incoming.get("user-agent");
+  if (userAgent && !headers.has("X-Client-User-Agent")) headers.set("X-Client-User-Agent", userAgent);
+  return headers;
+}
+function forwardedRequestHeaders(request, init) {
+  return applyForwardedClientHeaders(request.headers, new Headers(init));
+}
+
+// src/access/snapshot.ts
+var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "saas_app", "workspace"]);
+function emptySnapshot(subjectId = "") {
+  return {
+    subject_id: subjectId,
+    access_version: 0,
+    is_owner: false,
+    active: false,
+    platform_role: "",
+    permissions: [],
+    dash_roles: {},
+    workspace_permissions: {},
+    workspace_roles: {}
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fail(field, why) {
+  throw new AccessSnapshotError("invalid_snapshot", `access snapshot: ${field} ${why}`);
+}
+function parseAccessSnapshot(input) {
+  if (!isRecord(input)) fail("payload", "is not an object");
+  const { subject_id, access_version, is_owner, active, platform_role, permissions, dash_roles, workspace_permissions, workspace_roles } = input;
+  if (typeof subject_id !== "string" || subject_id === "") fail("subject_id", "must be a non-empty string");
+  if (typeof access_version !== "number" || !Number.isInteger(access_version) || access_version < 0) fail("access_version", "must be a non-negative integer");
+  if (typeof is_owner !== "boolean") fail("is_owner", "must be a boolean");
+  if (typeof active !== "boolean") fail("active", "must be a boolean");
+  if (platform_role !== void 0 && platform_role !== null && typeof platform_role !== "string") fail("platform_role", "must be a string");
+  if (!Array.isArray(permissions)) fail("permissions", "must be an array");
+  const entries = permissions.map((raw, i) => {
+    if (!isRecord(raw)) fail(`permissions[${i}]`, "is not an object");
+    const { key, scope_type, scope_id } = raw;
+    if (typeof key !== "string" || key === "") fail(`permissions[${i}].key`, "must be a non-empty string");
+    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|saas_app|workspace");
+    if (scope_id !== void 0 && scope_id !== null && typeof scope_id !== "string") fail(`permissions[${i}].scope_id`, "must be a string");
+    return { key, scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
+  });
+  const dashRoles = {};
+  if (dash_roles !== void 0 && dash_roles !== null) {
+    if (!isRecord(dash_roles)) fail("dash_roles", "must be an object");
+    for (const [dash, role] of Object.entries(dash_roles)) {
+      if (typeof role !== "string") fail(`dash_roles[${dash}]`, "must be a string");
+      dashRoles[dash] = role;
+    }
+  }
+  const wsPerms = {};
+  if (workspace_permissions !== void 0 && workspace_permissions !== null) {
+    if (!isRecord(workspace_permissions)) fail("workspace_permissions", "must be an object");
+    for (const [ws, keys] of Object.entries(workspace_permissions)) {
+      if (!Array.isArray(keys) || keys.some((k) => typeof k !== "string")) fail(`workspace_permissions[${ws}]`, "must be a string array");
+      wsPerms[ws] = [...keys];
+    }
+  }
+  const wsRoles = {};
+  if (workspace_roles !== void 0 && workspace_roles !== null) {
+    if (!isRecord(workspace_roles)) fail("workspace_roles", "must be an object");
+    for (const [ws, role] of Object.entries(workspace_roles)) {
+      if (typeof role !== "string") fail(`workspace_roles[${ws}]`, "must be a string");
+      wsRoles[ws] = role;
+    }
+  }
+  return {
+    subject_id,
+    access_version,
+    is_owner,
+    active,
+    platform_role: typeof platform_role === "string" ? platform_role : "",
+    permissions: entries,
+    dash_roles: dashRoles,
+    workspace_permissions: wsPerms,
+    workspace_roles: wsRoles
+  };
+}
+
+// src/access/fetch.ts
+var DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
+async function fetchAccessSnapshot(opts) {
+  const url = `${resolveValue(opts.apiUrl).replace(/\/$/, "")}${opts.endpointPath ?? DEFAULT_ACCESS_ENDPOINT_PATH}`;
+  const headers = opts.request ? forwardedRequestHeaders(opts.request, opts.headers) : new Headers(opts.headers);
+  headers.set("Authorization", `Bearer ${opts.accessToken}`);
+  headers.set("Accept", "application/json");
+  let response;
+  try {
+    response = await timedFetch(url, {
+      init: { method: "GET", headers },
+      timeoutMs: opts.fetchTimeoutMs,
+      fetchImpl: opts.fetchImpl
+    });
+  } catch (error) {
+    throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);
+  }
+  if (response.status === 401) throw new AccessSnapshotError("unauthenticated", "session expired", 401);
+  if (response.status === 403) throw new AccessSnapshotError("forbidden", "access snapshot refused", 403);
+  if (!response.ok) throw new AccessSnapshotError("unavailable", `access snapshot returned ${response.status}`, response.status);
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new AccessSnapshotError("invalid_snapshot", "access snapshot body is not JSON", response.status);
+  }
+  return parseAccessSnapshot(body);
+}
+
+// src/access/predicates.ts
+function entryCoversApp(entry, saasApp) {
+  switch (entry.scope_type) {
+    case "platform":
+      return true;
+    case "saas_app":
+      if (saasApp === void 0) return true;
+      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
+    default:
+      return false;
+  }
+}
+function hasPermission(snapshot, key, opts = {}) {
+  if (!snapshot.active) return false;
+  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
+}
+function hasAnyPermission(snapshot, keys, opts = {}) {
+  return keys.some((key) => hasPermission(snapshot, key, opts));
+}
+function hasAllPermissions(snapshot, keys, opts = {}) {
+  return keys.every((key) => hasPermission(snapshot, key, opts));
+}
+function hasWorkspacePermission(snapshot, workspaceId, key) {
+  if (!snapshot.active) return false;
+  if (snapshot.is_owner) return true;
+  return (snapshot.workspace_permissions[workspaceId] ?? []).includes(key);
+}
+function managedDashes(snapshot) {
+  if (!snapshot.active) return [];
+  return Object.entries(snapshot.dash_roles).map(([saasApp, role]) => ({ saasApp, role })).sort((a, b) => a.saasApp.localeCompare(b.saasApp));
+}
+function dashRole(snapshot, saasApp) {
+  if (!snapshot.active) return "";
+  return snapshot.dash_roles[saasApp] ?? "";
+}
+function isPlatformOwner(snapshot) {
+  return snapshot.active && snapshot.is_owner;
+}
+function appScopes(snapshot, key) {
+  if (!snapshot.active) return { all: false, apps: [] };
+  const apps = /* @__PURE__ */ new Set();
+  for (const entry of snapshot.permissions) {
+    if (entry.key !== key) continue;
+    if (entry.scope_type === "platform") return { all: true, apps: [] };
+    if (entry.scope_type === "saas_app") {
+      if (entry.scope_id === "*") return { all: true, apps: [] };
+      apps.add(entry.scope_id.toLowerCase());
+    }
+  }
+  return { all: false, apps: [...apps].sort() };
+}
+function permissionsFor(snapshot, opts = {}) {
+  if (!snapshot.active) return [];
+  const keys = /* @__PURE__ */ new Set();
+  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.saasApp)) keys.add(entry.key);
+  return [...keys].sort();
+}
+
+// src/access/generated/keys.ts
+var PLATFORM_PERMISSIONS = [
+  "affiliates.finance.manage",
+  "affiliates.partners.manage",
+  "affiliates.programmes.manage",
+  "affiliates.view",
+  "linkservice.domains.manage",
+  "linkservice.links.manage",
+  "linkservice.qr.manage",
+  "linkservice.view",
+  "platform.admin.view",
+  "platform.audit.view",
+  "platform.auth.manage",
+  "platform.billing.manage",
+  "platform.channels.manage",
+  "platform.channels.view",
+  "platform.config.manage",
+  "platform.docs.manage",
+  "platform.docs.view",
+  "platform.observability.manage",
+  "platform.observability.view",
+  "platform.offboarding.view",
+  "platform.ops.manage",
+  "platform.support.impersonate",
+  "platform.support.sessions",
+  "platform.tenants.archive",
+  "platform.tenants.manage",
+  "platform.tenants.restore",
+  "platform.users.deactivate",
+  "platform.users.delete",
+  "platform.users.invite",
+  "platform.users.manage_access",
+  "platform.users.reactivate",
+  "platform.users.view"
+];
+var DASH_PERMISSIONS = [
+  "dash.apps.manage",
+  "dash.billing.manage",
+  "dash.channels.manage",
+  "dash.customers.manage",
+  "dash.domains.manage",
+  "dash.members.manage",
+  "dash.ownership.transfer",
+  "dash.plans.manage",
+  "dash.publish",
+  "dash.settings.manage",
+  "dash.workspaces.admin",
+  "dash.workspaces.manage"
+];
+var DASH_ROLES = [
+  "dash.admin",
+  "dash.owner"
+];
+var LEADBROKER_PERMISSIONS = [
+  "leadbroker.finance.manage",
+  "leadbroker.leads.dispatch",
+  "leadbroker.leads.review",
+  "leadbroker.leads.view",
+  "leadbroker.policy.manage"
+];
+var WORKSPACE_PERMISSIONS = [
+  "workspace.channels.manage",
+  "workspace.channels.secrets",
+  "workspace.channels.view",
+  "workspace.crm.manage",
+  "workspace.crm.view",
+  "workspace.customers.manage",
+  "workspace.customers.view",
+  "workspace.orders.manage",
+  "workspace.orders.view",
+  "workspace.payments.record",
+  "workspace.site.edit",
+  "workspace.site.view",
+  "workspace.staff.manage"
+];
+var WORKSPACE_ROLES = [
+  "workspace.editor",
+  "workspace.frontdesk",
+  "workspace.manager"
+];
+
+// src/access/generated/stages.ts
+var PIPELINE_STAGES = ["created", "awaiting_payment", "provisioning", "attention", "active"];
+function isPipelineStage(value) {
+  return typeof value === "string" && PIPELINE_STAGES.includes(value);
+}
+
+// src/access/next.ts
 function accessCacheTag(subjectId) {
   return `access:${subjectId}`;
 }
@@ -72,4 +402,4 @@ function createAccessLoader(options) {
   return { getAccess, getAccessOrNull, requireAccess, requireWorkspaceAccess, invalidateAccess, cacheTag: tag };
 }
 
-export { accessCacheTag, createAccessLoader };
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PIPELINE_STAGES, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, accessCacheTag, appScopes, createAccessLoader, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };

package/dist/index-BnchfjP_.d.ts

@@ -0,0 +1,235 @@
+import '@c1m-public/transport';
+
+interface SessionUser {
+    id: string;
+    email: string;
+    name: string;
+    role: string;
+    is_active: boolean;
+    email_verified: boolean;
+    created_at: string;
+    last_login_at?: string;
+    has_passkey?: boolean;
+}
+interface SessionData {
+    user: SessionUser;
+    token: string;
+    exp: number;
+    iat: number;
+}
+type TokenPayload = Record<string, unknown> & {
+    sub?: string;
+    exp?: number;
+    iat?: number;
+    actor_id?: string;
+    effective_user_id?: string;
+    customer_id?: string;
+    user_id?: string;
+    aud?: string | string[];
+    email?: string;
+    name?: string;
+    role?: string;
+    is_active?: boolean;
+    email_verified?: boolean;
+    created_at?: string;
+    has_passkeys?: boolean;
+};
+declare function decodeBase64Url(input: string): string | null;
+declare function decodeTokenPayload(token: string): TokenPayload | null;
+declare function hasTokenAudience(token: string, requiredAudience: string): boolean;
+/** Cookie max-age clamped to the token's remaining lifetime. */
+declare function tokenMaxAgeSeconds(token: string, configuredMaxAge: number): number;
+declare function isTokenExpired(token: string): boolean;
+declare function isTokenExpiringSoon(token: string, bufferSeconds?: number): boolean;
+declare function decodeDefaultSession(token: string): SessionData | null;
+/** Backend auth response shape shared by verify-code, OIDC complete, and handoff exchange. */
+interface AuthResponse {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_at: string;
+    user: Record<string, unknown>;
+}
+declare function parseAuthResponse(value: unknown): AuthResponse | null;
+
+/**
+ * Strict same-origin return path: must start with `/`, not `//` or contain `://`,
+ * no encoded slashes or control chars, and round-trip URL parsing unchanged.
+ * Returns the value verbatim (query/hash kept) or null.
+ */
+declare function safeInternalPath(raw: string | null | undefined): string | null;
+
+interface CookieOptions {
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+    path?: string;
+    maxAge?: number;
+}
+declare function readCookie(request: Request, name: string): string | null;
+declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
+declare function setCookie(response: Response, name: string, value: string, options?: CookieOptions): Response;
+declare function deleteCookie(response: Response, name: string, options?: Pick<CookieOptions, "path" | "secure">): Response;
+
+/**
+ * Per-browser identity sent as `X-Client-Device-ID`; c1m-server refuses to
+ * create a session without it. Informational only, no authority.
+ */
+interface DeviceIdentity {
+    value: string;
+    created: boolean;
+}
+interface DeviceIdentityConfig {
+    cookieName: string;
+    secure?: boolean;
+    maxAgeSeconds?: number;
+}
+declare function createDeviceIdentity(config: DeviceIdentityConfig): {
+    read(request: Request): DeviceIdentity;
+    persist(response: Response, identity: DeviceIdentity): Response;
+};
+type DeviceIdentityStore = ReturnType<typeof createDeviceIdentity>;
+
+declare const HANDOFF_ERROR_MESSAGES: Record<string, string>;
+declare const HANDOFF_ERROR_FALLBACK = "Sign-in failed \u2014 please try again.";
+declare const SSO_ERROR_MESSAGES: Record<string, string>;
+/** Every sign-in failure code this package knows: handoff, admission, and SSO. */
+declare const AUTH_ERROR_MESSAGES: Record<string, string>;
+declare function handoffErrorMessage(code: string | null | undefined): string;
+declare function isHandoffErrorCode(code: string | null | undefined): boolean;
+/**
+ * Resolve any sign-in failure code to copy. `overrides` wins, so a surface can
+ * reword a shared code or add its own without forking the whole map.
+ */
+declare function authErrorMessage(code: string | null | undefined, overrides?: Record<string, string>): string;
+declare function isAuthErrorCode(code: string | null | undefined, overrides?: Record<string, string>): boolean;
+
+/** A value that may be fixed or resolved per call (env read at request time). */
+type Resolvable<T = string> = T | (() => T);
+/** A value, a sync resolver, or an async resolver. */
+type AsyncResolvable<T> = T | (() => T | Promise<T>);
+
+declare function sourceStartPath(app: string): string;
+declare function brokerPaths(app: string): {
+    readonly start: `/api/v1/platform/auth/handoffs/${string}/start`;
+    readonly exchange: `/api/v1/platform/auth/handoffs/${string}/exchange`;
+};
+interface HandoffTargetConfig {
+    app: string;
+    apiUrl: Resolvable;
+    audience: string;
+    clientType: string;
+    sources: Record<string, Resolvable>;
+    defaultSource: string;
+    cookiePrefix: string;
+    loginPath: string;
+    defaultReturnPath: string;
+    device: DeviceIdentityStore;
+    /** Write session cookies onto `response` (or return void if written via a framework store). */
+    establishSession: (session: AuthResponse, response: Response, request: Request) => Promise<Response | void> | Response | void;
+    secureCookies?: boolean;
+    timeoutMs?: number;
+    /** @deprecated use `timeoutMs`. */
+    fetchTimeoutMs?: number;
+    fetch?: typeof fetch;
+}
+declare function createHandoffTarget(config: HandoffTargetConfig): {
+    cookies: {
+        readonly state: `${string}state`;
+        readonly verifier: `${string}verifier`;
+        readonly from: `${string}from`;
+    };
+    /** GET `?source=&from=` */
+    start(request: Request): Promise<Response>;
+    /** GET `?code=&state=` */
+    callback(request: Request): Promise<Response>;
+};
+type HandoffTarget = ReturnType<typeof createHandoffTarget>;
+interface HandoffSourceTarget {
+    origin: Resolvable;
+    callbackPath?: string;
+    loginPath?: string;
+}
+interface HandoffSourceConfig {
+    apiUrl: Resolvable;
+    clientType: string;
+    targets: Record<string, HandoffSourceTarget>;
+    /** Live bearer or null when signed out; refresh an expiring token before returning it. */
+    getAccessToken: (request: Request) => Promise<string | null> | string | null;
+    loginPath: string;
+    timeoutMs?: number;
+    /** @deprecated use `timeoutMs`. */
+    fetchTimeoutMs?: number;
+    fetch?: typeof fetch;
+}
+declare function createHandoffSource(config: HandoffSourceConfig): {
+    /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
+    start(request: Request, app: string): Promise<Response>;
+};
+type HandoffSource = ReturnType<typeof createHandoffSource>;
+
+/**
+ * Coalesced refresh-token exchange for a BFF proxy: same refresh token within
+ * a short window shares one backend call. Per-process best effort; backend
+ * reuse detection is the correctness guarantee.
+ */
+interface RefreshedSession {
+    accessToken: string;
+    refreshToken?: string;
+}
+interface SessionRefresherConfig {
+    /** Backend origin, no /api/v1. May resolve asynchronously (a tenant-scoped origin). */
+    apiUrl: AsyncResolvable<string>;
+    /** e.g. /api/v1/platform/auth/refresh; empty when `apiUrl` already resolves to the full URL. */
+    refreshPath: string;
+    /** Extra request headers, e.g. a service credential and its tenant selector. */
+    headers?: AsyncResolvable<HeadersInit | undefined>;
+    clientType: string;
+    audience: string;
+    singleflightTtlMs?: number;
+    maxSingleflights?: number;
+    timeoutMs?: number;
+    /** @deprecated use `timeoutMs`. */
+    fetchTimeoutMs?: number;
+    fetch?: typeof fetch;
+}
+/**
+ * Two refresh envelopes exist: the platform one (flat, with token_type and
+ * expires_at) and the end-user one (`{ data: { access_token, refresh_token? } }`,
+ * where a rotated refresh token is optional). Both carry the access token the
+ * same way; that is all a refresh needs.
+ */
+declare function parseRefreshEnvelope(value: unknown): RefreshedSession | null;
+declare function createSessionRefresher(config: SessionRefresherConfig): {
+    refresh(refreshToken: string): Promise<RefreshedSession | null>;
+    size(): number;
+};
+type SessionRefresher = ReturnType<typeof createSessionRefresher>;
+
+declare function hasSessionShape(token: string | undefined | null): boolean;
+type SessionGateDecision = {
+    kind: "pass";
+    refreshed?: RefreshedSession;
+} | {
+    kind: "redirect_home";
+    refreshed?: RefreshedSession;
+} | {
+    kind: "anonymous_public";
+} | {
+    kind: "unauthorized_api";
+} | {
+    kind: "redirect_login";
+};
+interface SessionGateInput {
+    accessToken?: string | null;
+    refreshToken?: string | null;
+    audience: string;
+    refresher: Pick<SessionRefresher, "refresh">;
+    isPublic: boolean;
+    isLoginPath: boolean;
+    isApiPath: boolean;
+    expiringSoonBufferSeconds?: number;
+}
+declare function evaluateSessionGate(input: SessionGateInput): Promise<SessionGateDecision>;
+
+export { type AsyncResolvable as A, deleteCookie as B, type CookieOptions as C, type DeviceIdentity as D, evaluateSessionGate as E, handoffErrorMessage as F, hasSessionShape as G, HANDOFF_ERROR_FALLBACK as H, hasTokenAudience as I, isAuthErrorCode as J, isHandoffErrorCode as K, isTokenExpired as L, isTokenExpiringSoon as M, parseAuthResponse as N, parseRefreshEnvelope as O, readCookie as P, safeInternalPath as Q, type Resolvable as R, type SessionData as S, type TokenPayload as T, serializeCookie as U, setCookie as V, sourceStartPath as W, tokenMaxAgeSeconds as X, AUTH_ERROR_MESSAGES as a, type AuthResponse as b, type DeviceIdentityConfig as c, type DeviceIdentityStore as d, HANDOFF_ERROR_MESSAGES as e, type HandoffSource as f, type HandoffSourceConfig as g, type HandoffSourceTarget as h, type HandoffTarget as i, type HandoffTargetConfig as j, type RefreshedSession as k, SSO_ERROR_MESSAGES as l, type SessionGateDecision as m, type SessionGateInput as n, type SessionRefresher as o, type SessionRefresherConfig as p, type SessionUser as q, authErrorMessage as r, brokerPaths as s, createDeviceIdentity as t, createHandoffSource as u, createHandoffTarget as v, createSessionRefresher as w, decodeBase64Url as x, decodeDefaultSession as y, decodeTokenPayload as z };