import type { AuthProvider, User, ClientConfig } from "@bounded-sh/core";
import type { InjectedSolanaProvider } from "./providers/injected-wallet-types";
import { type MobileWalletStatus } from "./providers/solana-mobile-registration";
export { WalletConfigError } from "./providers/solana-mobile-registration";
/**
 * Clears the session if it was created by a different auth method.
 * Returns true if the session was cleared, false if the session is compatible.
 *
 * Dispatches to the correct session manager based on the current auth method
 * so both web (WebSessionManager) and RN (ReactNativeSessionManager) sessions
 * are properly cleared.
 */
export declare function clearIncompatibleSession(): Promise<boolean>;
/**
 * The ONE authoritative Solana network for the wallet lane.
 *
 * The wallet-lane override wins over the app-wide chain because that is what
 * actually signs: InjectedWalletProvider resolves `walletLogin.network` /
 * `injectedWalletConfig.network` ahead of the top-level chain for both RPC and
 * the Wallet-Standard chain id. Registration, wallet discovery and the provider
 * must all read this same value - the mobile wallet authorizes per cluster, so
 * two answers means authorizing on one and being asked to sign on the other.
 */
export declare function getConfiguredSolanaNetwork(config: Partial<ClientConfig>): string | null;
/**
 * Whether the app opted into Solana WALLET LOGIN at init(). OPT-IN, default OFF:
 * enabled only when the developer explicitly passes `walletLogin: true` (or a
 * `walletLogin` / `injectedWalletConfig` object). This gate is what keeps wallet
 * login from being usable (or advertised) by the vast majority of apps that
 * never want it — existing apps that don't opt in see ZERO behavior change.
 */
export declare function isWalletLoginEnabled(config: Partial<ClientConfig>): boolean;
/**
 * Whether the app explicitly turned the "connect wallet" lane OFF at init()
 * (`walletLogin: false`). This is the hard opt-OUT the unified widget honors: it
 * hides the wallet option entirely even when an injected wallet is detected and
 * even if a per-call `openBoundedWidget({ wallet: true })` asked for it.
 */
export declare function isWalletLoginDisabled(config: Partial<ClientConfig>): boolean;
/**
 * Site policy: the app requires an email on file for every user (`requireEmail:
 * true`). Native wallet login carries no email, so the unified widget suppresses
 * the wallet lane when this is set - email/social (which yields an email) remain.
 * This lets a policy deny wallet-only accounts without touching per-call options.
 */
export declare function isEmailRequired(config: Partial<ClientConfig>): boolean;
/** The config passed to the last `init()`, or null before init. Read-only view
 *  for runtime surfaces (e.g. the unified login widget) that need wallet/rpc
 *  settings without re-plumbing them through every call. */
export declare function getInitConfig(): Partial<ClientConfig> | null;
/**
 * Which LOGIN mode the app runs (default "turnkey"). Turnkey-native email OTP keeps
 * code entry inline in the unified widget (no OIDC popup), and Bounded mints the
 * session from Turnkey's verification. Apps can explicitly select "bounded" for the
 * legacy Better Auth email flow. A per-call openBoundedWidget option can override it.
 */
export declare function resolveAuthMode(config: Partial<ClientConfig>): 'bounded' | 'turnkey';
export { SOLANA_DEVNET_RPC_URL, SOLANA_MAINNET_RPC_URL, } from "./solana-rpc";
export declare function getAuthProvider(config?: Partial<ClientConfig>): Promise<AuthProvider>;
/** Per-call overrides forwarded to the active auth provider's modal. */
export interface LoginOptions {
    /** Override the modal theme just for this login call: 'light' or 'dark'. */
    theme?: 'light' | 'dark';
    /** Override the modal title just for this login call. */
    modalTitle?: string;
    /** Override the modal subtitle just for this login call. */
    modalSubtitle?: string;
}
/**
 * Anonymous ("guest") sign-in: zero-friction auth backed by a device-local
 * ed25519 keypair (no email, no wallet, no popup). The keypair is generated +
 * persisted on the device; its public key becomes `@user.address`. Durable
 * across reloads. Upgrade later by linking an email; transfer accounts via the
 * ownership-as-data pattern. `init()` must have run first. Browser/RN only.
 */
export declare function signInAnonymously(): Promise<User | null>;
/**
 * Log in with Privy as a co-equal route — selectable at runtime alongside
 * `login()` (email/wallet) and `signInAnonymously()`, without re-`init()`.
 *
 * On REACT NATIVE the host must have created a PrivyExpoProvider and bridged the
 * Privy hooks via setPrivyMethods() (pass it as `config.privyExpoProvider` to
 * init()) — RN can't construct it here because the Privy hooks live in the app's
 * component tree. Web Privy is no longer loaded through the default client entry;
 * opt into a dedicated provider entry when your app needs it.
 *
 * Either way the Privy Solana wallet signs the SIWS challenge, so the session is
 * minted via the same wallet path as Phantom and shares the unified session store
 * (web localStorage / RN storage) and identity model. `init()` must have run first.
 */
export declare function loginWithPrivy(options?: LoginOptions): Promise<User | null>;
/**
 * What a wallet login needs, once it is genuinely ready.
 *
 * `mobileWallet` reports the phone wallet separately from the rest, because the
 * two degrade differently: if the shared work (config, the provider chunk)
 * fails there is no wallet login at all, but if only the mobile wallet fails,
 * every injected wallet still works and the caller should carry on without it.
 */
export interface WalletLoginReadiness {
    mobileWallet: MobileWalletStatus;
}
/**
 * Prepare the work EVERY wallet login needs, whichever wallet is used: resolved
 * configuration and the code-split wallet provider. Enough on its own when the
 * caller already knows which wallet it wants.
 *
 * Rejects if that work fails, which means there is no wallet login at all.
 */
export declare function ensureSharedWalletLoginReady(): Promise<void>;
/**
 * Prepare everything a wallet login needs, and resolve only when it is ready.
 *
 * `loginWithWallet` resolves config, code-splits the provider and registers the
 * mobile wallet. On a cold page that work would otherwise land between the
 * user's tap and the wallet handoff - the pre-connect delay that costs Chrome's
 * transient activation and makes the mobile wallet's intent navigation fail. So
 * call this when your wallet control becomes visible and AWAIT it before
 * enabling that control.
 *
 * Must be called after `init()`: the mobile wallet is registered for the app's
 * configured Solana network, and that registration cannot be withdrawn.
 *
 * REJECTS only when the SHARED work fails - there is then no wallet login at
 * all. A mobile-wallet failure instead resolves with `mobileWallet: 'failed'`,
 * because every injected wallet still works and a caller that offers those
 * should carry on without the phone wallet. The mobile half keeps its own
 * per-configuration memo, so a failure there stays retryable and a re-init for
 * another network is never served the previous registration.
 */
export declare function ensureWalletLoginReady(): Promise<WalletLoginReadiness>;
/** @deprecated Use {@link ensureWalletLoginReady}, which reports what is ready. */
export declare function preloadWalletLogin(): Promise<WalletLoginReadiness>;
/**
 * Log in with an injected Solana WALLET (Phantom / Solflare / Backpack / any
 * Wallet-Standard `window.solana`) as a co-equal RUNTIME route - selectable
 * alongside `login()` / hosted `loginWithPopup()` / `signInAnonymously()` WITHOUT
 * re-`init()`. This is the "Continue with wallet" choice the unified Bounded
 * login widget offers: it NEVER touches Better Auth - the user's real wallet
 * becomes `@user.address` and login is a SIWS signature.
 *
 * `getProvider` pins a specific discovered wallet (e.g. when the widget lists
 * several); omit it to use Phantom-first discovery. Must be called from a user
 * gesture so the wallet's connect prompt is allowed. `init()` must have run first.
 */
export declare function loginWithWallet(options?: {
    getProvider?: () => InjectedSolanaProvider | null | undefined;
    /** Awaited right before the login signature, to collect a fresh user
     *  gesture. Needed by wallets that leave the page to sign (Solana
     *  Mobile); the per-operation equivalent for everything an app signs
     *  later is `walletLogin.confirmWalletAction` at init(). */
    confirmSignIn?: () => Promise<void>;
}): Promise<User | null>;
export declare function login(options?: LoginOptions): Promise<User | null>;
export declare function getCurrentAuthMethod(): string | null;
export interface LogoutOptions {
    /** Keep the hosted issuer's browser session alive (skip the top-level bounce
     *  through the issuer's /logout). Default false: an explicit logout ends the
     *  issuer session too, so the next sign-in is a fresh account choice instead
     *  of a silent re-login as the same user. */
    keepIssuerSession?: boolean;
}
export declare function logout(options?: LogoutOptions): Promise<void>;
export { loginWithRedirect, completeLoginFromRedirect, loginWithPopup, completeLoginInPopup } from './oidc-auth';
export type { HostedAuthMethod, OidcLoginOptions, PopupLoginOptions } from './oidc-auth';