/**
 * @typedef {"authenticated" | "unauthenticated" | "recovery-pending" | "integration-failed"} SessionState
 */

/**
 * The session is opaque: credentials are attached without exposing tokens.
 *
 * @typedef {{
 *   getState(): SessionState,
 *   subscribe(listener: () => void): () => void,
 *   beginSignIn(returnTo?: string): Promise<void>,
 *   signOut(): Promise<void>,
 *   recover(): Promise<"restored" | "no-session">
 * }} SessionGateway
 */

/**
 * Credential attachment is an HTTP-adapter collaboration, not an application
 * input capability.
 *
 * @typedef {{
 *   attach(request: Request): Promise<Request>,
 *   onUnauthenticated(): void
 * }} CredentialAttacher
 */

/**
 * External auth adapters implement both segregated capabilities.
 *
 * @typedef {SessionGateway & CredentialAttacher} AuthSessionPort
 */

export {};