import type { User } from '@bounded-sh/core';
export type HostedAuthMethod = 'email' | 'text' | 'phone' | 'google' | 'apple' | 'github' | (string & {});
export interface OidcLoginOptions {
    /**
     * Where the issuer returns the user after login. OPTIONAL on web — defaults to the
     * CURRENT page (`window.location.origin + pathname`), so the user lands back where they
     * started and `completeLoginFromRedirect()` finishes it. REQUIRED on React Native: pass
     * the https universal link whose origin the app owner registered.
     */
    redirectUri?: string;
    /**
     * Hosted-login methods to show. Omit to show every method enabled on the
     * Bounded issuer. Include social provider ids directly, e.g.
     * `['email', 'google']` or `['google', 'github']`. `text`/`phone`
     * are shown only when the issuer explicitly enables text OTP.
     */
    methods?: readonly HostedAuthMethod[];
    /**
     * Start this provider immediately. Use for app-owned buttons like
     * "Continue with Google". For `provider: 'email'`, the hosted OTP form is
     * shown without social alternatives. `provider: 'text'`/`'phone'` works only
     * when the issuer explicitly enables text OTP. A social provider jump
     * defaults `prompt` to `'select_account'` (see `prompt`).
     */
    provider?: HostedAuthMethod;
    /**
     * Standard OIDC `prompt`. Pass `'login'` to FORCE a fresh sign-in even if the
     * issuer already has a session — so the user can choose a DIFFERENT account
     * (e.g. retry with another email after an access denial) instead of being
     * silently re-signed-in as the same one. `'select_account'` behaves the same.
     * When `provider` names a social IdP (anything but the identifier-first
     * `email`/`text`/`phone`), an omitted `prompt` DEFAULTS to `'select_account'`
     * so "Continue with Google" always offers the account chooser instead of
     * silently reusing a live issuer session; pass `prompt: ''` to opt back into
     * silent SSO for that jump.
     */
    prompt?: 'login' | 'select_account' | 'consent' | 'none' | (string & {});
    /**
     * Standard OIDC `login_hint` - prefill the identifier (e.g. the email the user
     * already typed in the unified widget's card) so the hosted page can skip
     * straight to the OTP step instead of asking for it again.
     */
    loginHint?: string;
}
export interface PopupLoginOptions extends OidcLoginOptions {
    width?: number;
    height?: number;
}
/** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
 *
 *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
 *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
 *
 *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
 *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
 *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
 *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
 *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
 *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
export declare function loginWithRedirect(opts: OidcLoginOptions): Promise<User | void>;
/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
 *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
 *
 *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
 *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
 *  page to finish from. Calling it on RN is harmless. */
export declare function completeLoginFromRedirect(): Promise<User | null>;
/** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
 *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
 *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
export declare function loginWithPopup(opts: PopupLoginOptions): Promise<User>;
/** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
 *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
export declare function completeLoginInPopup(openerOrigin: string): void;
export declare function establishInlineSession(data: {
    idToken?: string;
    id_token?: string;
    accessToken?: string;
    access_token?: string;
    refreshToken?: string;
    bounded_refresh_token?: string;
}): Promise<User>;
export declare function inlineAuthEndpoint(): Promise<{
    base: string;
    appId: string;
}>;