import { ReactNode, ReactElement } from 'react';
import { D as DavepiClient } from '../client-BLdA4Ob7.js';

interface AuthUser {
    user_id: string;
    email: string;
    roles: string[];
    [key: string]: unknown;
}
interface AuthContextValue {
    client: DavepiClient;
    baseUrl: string;
    user: AuthUser | null;
    accessToken: string | null;
    status: 'unknown' | 'authenticated' | 'unauthenticated';
    login(email: string, password: string): Promise<void>;
    logout(): Promise<void>;
    register(input: RegisterInput): Promise<void>;
    /**
     * Adopt an access + refresh token pair obtained outside the password
     * flow — e.g. the `?token=…&refreshToken=…` an OAuth provider lands on the
     * callback URL. Runs through the same path as `login`: decodes the JWT,
     * flips `status` to `'authenticated'`, persists the refresh token under the
     * canonical key (so reloads and the 401 interceptor refresh normally), and
     * unblocks every data hook. Synchronous — no network round-trip.
     */
    setSession(tokens: SessionTokens): void;
}
/** A davepi access + refresh token pair, as returned by login or OAuth. */
interface SessionTokens {
    accessToken: string;
    refreshToken: string;
}
interface RegisterInput {
    email: string;
    password: string;
    first_name?: string;
    last_name?: string;
    [key: string]: unknown;
}
interface AuthProviderProps {
    baseUrl: string;
    children: ReactNode;
    /** Override storage mechanism (defaults to localStorage). */
    storage?: Pick<Storage, 'getItem' | 'setItem' | 'removeItem'>;
    /** Override fetch impl (tests). */
    fetch?: typeof fetch;
}
declare function AuthProvider({ baseUrl, children, storage, fetch: fetchImpl, }: AuthProviderProps): ReactElement;
declare function useAuth(): AuthContextValue;
/**
 * Like {@link useAuth} but returns `null` instead of throwing when no
 * `<AuthProvider>` is mounted. For hooks that can run on an alternative
 * data source (e.g. `useDescribe` under a `<DescribeProvider>`).
 */
declare function useOptionalAuth(): AuthContextValue | null;

/**
 * Renders `children` only when the viewer is authenticated (and, when
 * `roles` is provided, holds at least one of the listed roles).
 * Otherwise renders `fallback`. The fallback default is `null` so it is
 * safe to mount as a tree-wide guard.
 *
 * Server-side ACL is the source of truth; this guard only gates the UI.
 *
 * @example
 * <AuthGuard roles={['admin']} fallback={<LoginPage />}>
 *   <SettingsPage />
 * </AuthGuard>
 */
interface AuthGuardProps {
    children: ReactNode;
    fallback?: ReactNode;
    roles?: readonly string[];
    loadingFallback?: ReactNode;
}
declare function AuthGuard({ children, fallback, roles, loadingFallback, }: AuthGuardProps): ReactElement;

/**
 * Default login screen. Intentionally minimal — consumers wanting branded
 * login should drop in their own page that calls `useAuth().login`.
 *
 * @example
 * <Route path="/login" element={<LoginPage onSuccessRedirect="/" />} />
 */
interface LoginPageProps {
    onSuccessRedirect?: string;
    title?: string;
    /** Show a "register" link below the form. */
    registerHref?: string;
}
declare function LoginPage({ onSuccessRedirect, title, registerHref, }: LoginPageProps): ReactElement;

/**
 * Minimal user menu — email + logout button. Replace with a styled
 * variant in your app; this exists so the default shell is functional.
 *
 * @example
 * <header><UserMenu /></header>
 */
interface UserMenuProps {
    className?: string;
}
declare function UserMenu({ className }: UserMenuProps): ReactElement | null;

export { type AuthContextValue, AuthGuard, type AuthGuardProps, AuthProvider, type AuthProviderProps, type AuthUser, LoginPage, type LoginPageProps, type RegisterInput, type SessionTokens, UserMenu, type UserMenuProps, useAuth, useOptionalAuth };