import React from "react";
import { type Href } from "expo-router";
import { type AuthResponse, type User } from "../services/auth.service";
/**
 * Outcome of a passkey login attempt. Used by apps with a client-side
 * unlock step (e.g. vault's symmetric-key derivation) so the login
 * screen can route to either the home tab or a password-prompt dialog.
 *
 *   `unlocked: true`  — the authenticator honored PRF and the local
 *                       unlock work is done. Route to `routes.home`.
 *   `unlocked: false` — server accepted the assertion and the session
 *                       is established, but the consumer still needs
 *                       the master password. The login screen renders
 *                       its unlock dialog and calls `unlockWithPassword`.
 */
export interface PasskeyLoginResult {
    unlocked: boolean;
    user: User;
}
export interface LoginWithPasskeyOptions {
    /**
     * Request the "immediately-available-only, zero cross-app UI" variant
     * of the ceremony (native `getImmediate` / web `mediation: "silent"`):
     * succeeds only if a credential is available locally, with no
     * Credential Manager picker across other registered providers and no
     * modal at all on failure. Use for an auto-fired, opportunistic
     * attempt (e.g. a lock screen prompting for biometrics the moment it
     * mounts) — the normal path's full cross-app arbitration is correct
     * for an explicit "sign in with a passkey" tap, but was observed
     * colliding with another installed password manager's own autofill
     * prompt when fired automatically on every app launch. When true,
     * this call also skips the shared `isLoading`/`error` state below —
     * a background opportunistic check should not flash a loading state
     * or surface an error banner anywhere else in the app on failure.
     */
    silent?: boolean;
}
interface AuthContextType {
    user: User | null;
    isLoading: boolean;
    isAuthenticated: boolean;
    login: (email: string, password: string) => Promise<void>;
    /**
     * Drive a passkey ceremony end-to-end. Available when the consumer
     * provided `loginWithPasskey` to `AuthProvider`; throws otherwise.
     * `signal` aborts an in-flight WebAuthn ceremony on web — wire it
     * to a `useEffect` cleanup so unmounting the screen tears the OS
     * prompt down instead of leaving an orphaned resolution.
     */
    loginWithPasskey: (email?: string, signal?: AbortSignal, opts?: LoginWithPasskeyOptions) => Promise<PasskeyLoginResult>;
    /**
     * Complete a non-PRF passkey unlock by deriving the local key from
     * the master password. Available when the consumer provided
     * `unlockWithPassword` to `AuthProvider`.
     */
    unlockWithPassword: (password: string) => Promise<void>;
    register: (email: string, password: string, displayName?: string) => Promise<void>;
    logout: () => Promise<void>;
    refreshUser: () => Promise<void>;
    deleteAccount: (password: string) => Promise<void>;
    checkAuth: () => Promise<void>;
    error: string | null;
    clearError: () => void;
}
export interface AuthProviderProps {
    children: React.ReactNode;
    /**
     * Optional hook called after a successful login. Vault wires its
     * `KeyManager.unlock(password)` here; bootstrap leaves it unset.
     * Throwing rolls the login back via `AuthService.logout()` and bubbles
     * the error to the caller.
     */
    onAfterLogin?: (password: string, response: AuthResponse) => Promise<void> | void;
    /** Optional post-register hook (mirror of `onAfterLogin`). */
    onAfterRegister?: (password: string, response: AuthResponse) => Promise<void> | void;
    /**
     * Optional pre-logout hook. Vault wires `KeyManager.lock()` and
     * websocket teardown here; failures are swallowed to keep logout
     * idempotent.
     */
    onBeforeLogout?: () => Promise<void> | void;
    /**
     * Optional pre-checkAuth hook. Vault uses this to fetch the server's
     * HIBP policy alongside the initial session probe.
     */
    onBeforeCheckAuth?: () => Promise<void> | void;
    /**
     * Optional passkey-ceremony driver. When provided, `useAuth()` exposes
     * `loginWithPasskey`; the consumer owns the WebAuthn round-trip and the
     * post-assertion vault unlock. Returning `{ unlocked: true }` finishes
     * the flow; returning `{ unlocked: false }` keeps the session but tells
     * the screen to collect the master password and call `unlockWithPassword`.
     */
    loginWithPasskey?: (email?: string, signal?: AbortSignal, opts?: LoginWithPasskeyOptions) => Promise<PasskeyLoginResult>;
    /**
     * Optional master-password unlock. Used by the passkey flow when the
     * authenticator did not honor PRF.
     */
    unlockWithPassword?: (password: string) => Promise<void>;
    /**
     * Optional telemetry hook. Invoked with every error AuthProvider
     * would otherwise swallow into a `__DEV__`-gated `console.warn` —
     * post-login hook throw, post-register hook throw, refreshUser
     * failure, logout API failure, etc. Wire this to Sentry / Rollbar /
     * your structured-log shipper to get production visibility into
     * paths the UI hides from the user.
     *
     * The `context` string identifies the call site (`"login-hook"`,
     * `"register-hook"`, `"refresh-user"`, `"logout"`, …) so the
     * consumer can route or filter without parsing the error message.
     */
    onError?: (error: unknown, context: string) => void;
}
export declare function AuthProvider({ children, onAfterLogin, onAfterRegister, onBeforeLogout, onBeforeCheckAuth, loginWithPasskey: providedLoginWithPasskey, unlockWithPassword: providedUnlockWithPassword, onError, }: AuthProviderProps): React.JSX.Element;
export declare function useAuth(): AuthContextType;
export type { AuthContextType };
export declare function useRole(requiredRole: "Admin" | "User"): boolean;
export declare function useRequireAuth(redirectTo?: Href): {
    isAuthenticated: boolean;
    isLoading: boolean;
};
export declare function useSession(): {
    user: User | null;
};
export { validateEmail, validatePassword, validateUsername } from "../utils/validation";
export default useAuth;
//# sourceMappingURL=useAuth.d.ts.map