import { ActionCodeSettings, AuthProviderConfig, AuthProviderConfigFilter, CreateRequest, DecodedAuthBlockingToken, DecodedIdToken, DeleteUsersResult, GetUsersResult, ListProviderConfigResults, ListUsersResult, ProjectConfigManager, SessionCookieOptions, TenantAwareAuth, TenantManager, UpdateAuthProviderRequest, UpdateRequest, UserIdentifier, UserImportOptions, UserImportRecord, UserImportResult, UserRecord } from 'firebase-admin/auth';
import { IAuth } from './_internal/auth-types.js';
import { App } from 'firebase-admin/app';
import { InternalTenantManager } from './_internal/tenant-manager.js';
import { AuthKey } from './types.js';
/**
 * Base implementation of the mock `firebase-admin/auth` interface.
 *
 * @remarks
 * This class encapsulates common behaviour for both project-wide and
 * tenant-aware auth instances. It delegates all user storage to
 * {@link InternalTenantManager}, and focuses on reproducing the
 * behaviour of:
 *
 * - Custom token creation and verification
 * - ID token and session cookie verification (including revocation)
 * - Basic user CRUD
 * - Custom claims management
 * - Provider configuration management
 * - Action-link generation (password reset, email verification, etc.)
 *
 * Concrete subclasses provide project-wide (`Auth`) and tenant-scoped
 * (`TenantAwareAuth`) entry points.
 */
export declare abstract class BaseAuth implements IAuth {
    protected readonly tenants: InternalTenantManager<AuthKey>;
    protected readonly _tenantId: string | undefined;
    /**
     * Creates a new base auth instance backed by a shared tenant manager.
     *
     * @param tenants - Shared {@link InternalTenantManager} responsible for
     * user and provider state.
     * @param tenantId - Optional tenant identifier to scope all operations,
     * or `undefined` for project-wide (non-tenant) scope.
     */
    constructor(tenants: InternalTenantManager<AuthKey>, tenantId?: string | undefined);
    /**
     * Returns the app associated with this Auth instance.
     *
     * @returns The app associated with this Auth instance.
     */
    get app(): App;
    /**
     * Creates a mock custom token for the specified UID and optional claims.
     *
     * @remarks
     * - Validates the UID format using {@link isValidUid}.
     * - Validates `developerClaims` using the same rules as custom user claims
     *   via {@link validatedCustomClaims}, for fidelity.
     * - Produces a signed JWT using {@link encodeJWT}. The signature is not
     *   verifiable by the real Admin SDK, but is sufficient for tests that
     *   only decode or inspect the payload.
     *
     * @param uid - UID of the user for whom to create a custom token.
     * @param developerClaims - Optional additional claims to embed in the token.
     * @returns A promise resolving to the encoded custom token, or rejecting
     * with an auth error if validation fails.
     */
    createCustomToken(uid: string, developerClaims?: object): Promise<string>;
    /**
     * Verifies a mock ID token and returns its decoded payload.
     *
     * @remarks
     * Behaviour mirrors the real Admin SDK as closely as practical:
     *
     * - Decodes the token using {@link decodeIdToken}.
     * - Validates expiry (`exp` vs current epoch).
     * - Optionally checks for revocation when `checkRevoked` is `true`, by
     *   comparing `auth_time`/`iat` against `tokensValidAfterTime`.
     * - Rejects for disabled users with `user-disabled`.
     *
     * Signature verification is **not** performed; tokens are trusted as
     * produced by this mock environment.
     *
     * @param idToken - Encoded ID token produced by this mock.
     * @param checkRevoked - Whether to reject tokens issued before
     * `tokensValidAfterTime`.
     * @returns A promise resolving to the decoded token, or rejecting with an
     * appropriate auth error.
     */
    verifyIdToken(idToken: string, checkRevoked?: boolean): Promise<DecodedIdToken>;
    /**
     * Retrieves a user by UID.
     *
     * @param uid - UID of the user to look up.
     * @returns A promise resolving to the corresponding {@link UserRecord},
     * or rejecting with `user-not-found` if the UID does not exist.
     */
    getUser(uid: string): Promise<UserRecord>;
    /**
     * Retrieves a user by primary email.
     *
     * @param email - Email address to look up.
     * @returns A promise resolving to the matched {@link UserRecord},
     * or rejecting with `user-not-found` if no user has this email.
     */
    getUserByEmail(email: string): Promise<UserRecord>;
    /**
     * Retrieves a user by primary phone number.
     *
     * @param phoneNumber - Phone number to look up.
     * @returns A promise resolving to the matched {@link UserRecord},
     * or rejecting with `user-not-found` if no user has this phone number.
     */
    getUserByPhoneNumber(phoneNumber: string): Promise<UserRecord>;
    /**
     * Retrieves a user by provider ID and provider-specific UID.
     *
     * @param providerId - Provider identifier (for example, `"google.com"`).
     * @param uid - Provider-specific UID for the user.
     * @returns A promise resolving to the matched {@link UserRecord},
     * or rejecting with `user-not-found`.
     */
    getUserByProviderUid(providerId: string, uid: string): Promise<UserRecord>;
    /**
     * Retrieves multiple users by a collection of identifiers.
     *
     * @remarks
     * For each identifier, the mock attempts to resolve the user by:
     *
     * - Email
     * - Phone number
     * - Provider ID + provider UID
     * - UID
     *
     * and partitions the results into `users` and `notFound` arrays.
     *
     * @param identifiers - Identifiers describing users to look up.
     * @returns A promise resolving to a {@link GetUsersResult} containing both
     * found and missing identifiers.
     */
    getUsers(identifiers: UserIdentifier[]): Promise<GetUsersResult>;
    /**
     * Lists users in the current tenant using cursor-based pagination.
     *
     * @remarks
     * - The mock uses a simple array slice plus numeric `pageToken`.
     * - The returned order is the internal iteration order of the backing store.
     *
     * @param maxResults - Maximum number of users to return in this page.
     * Defaults to `1000` if omitted.
     * @param pageToken - Optional numeric cursor (as a string) indicating the
     * starting index for the next page.
     * @returns A promise resolving to a {@link ListUsersResult} with users and
     * an optional `pageToken` for further pages.
     */
    listUsers(maxResults?: number, pageToken?: string): Promise<ListUsersResult>;
    /**
     * Creates a new user in the current tenant.
     *
     * @param properties - User properties matching {@link CreateRequest}.
     * @returns A promise resolving to the created {@link UserRecord}.
     */
    createUser(properties: CreateRequest): Promise<UserRecord>;
    /**
     * Deletes a user by UID from the current tenant.
     *
     * @param uid - UID of the user to delete.
     * @returns A promise that resolves if the user was deleted, or rejects
     * with `user-not-found` if the user does not exist.
     */
    deleteUser(uid: string): Promise<void>;
    /**
     * Deletes multiple users by UID from the current tenant.
     *
     * @remarks
     * The result records success and failure counts, along with any
     * `FirebaseArrayIndexError` entries corresponding to missing users.
     *
     * @param uids - UIDs to delete.
     * @returns A promise resolving to a {@link DeleteUsersResult}.
     */
    deleteUsers(uids: string[]): Promise<DeleteUsersResult>;
    /**
     * Updates a user by UID in the current tenant.
     *
     * @param uid - UID of the user to update.
     * @param properties - Partial update properties matching {@link UpdateRequest}.
     * @returns A promise resolving to the updated {@link UserRecord}.
     */
    updateUser(uid: string, properties: UpdateRequest): Promise<UserRecord>;
    /**
     * Sets or clears custom user claims for the specified user.
     *
     * @remarks
     * - When `customUserClaims` is non-null, it is validated using
     *   {@link validatedCustomClaims}.
     * - When `customUserClaims` is `null`, existing claims are removed.
     *
     * @param uid - UID of the user to modify.
     * @param customUserClaims - Claims object to store, or `null` to clear.
     * @returns A promise that resolves when the operation has completed or
     * rejects with an auth error if validation fails.
     */
    setCustomUserClaims(uid: string, customUserClaims: object | null): Promise<void>;
    /**
     * Revokes refresh tokens for a user by setting `tokensValidAfterTime`
     * to the current time.
     *
     * @remarks
     * Subsequent token verification calls with `checkRevoked: true` will
     * reject tokens issued before this time.
     *
     * @param uid - UID of the user whose tokens should be revoked.
     * @returns A promise that resolves once the revocation timestamp has
     * been updated.
     */
    revokeRefreshTokens(uid: string): Promise<void>;
    /**
     * Imports a batch of users into the current tenant.
     *
     * @remarks
     * - Hash options are currently ignored; any provided password hashes are
     *   trusted as-is.
     * - Errors encountered while importing individual users are captured in
     *   the {@link UserImportResult.errors} array.
     *
     * @param users - User records to import.
     * @param options - Optional import options; currently ignored in the mock.
     * @returns A promise resolving to a {@link UserImportResult}.
     */
    importUsers(users: UserImportRecord[], options?: UserImportOptions): Promise<UserImportResult>;
    /**
     * Creates a mock session cookie from an existing ID token.
     *
     * @remarks
     * - The ID token is decoded and re-encoded with a new `exp` field based
     *   on the supplied `expiresIn` duration.
     * - Signature verification is not performed.
     *
     * @param idToken - ID token to wrap as a session cookie.
     * @param sessionCookieOptions - Options specifying the `expiresIn`
     * duration in milliseconds.
     * @returns A promise resolving to the encoded session cookie.
     */
    createSessionCookie(idToken: string, sessionCookieOptions: SessionCookieOptions): Promise<string>;
    /**
     * Verifies a mock session cookie and returns its decoded payload.
     *
     * @remarks
     * Behaviour is analogous to {@link verifyIdToken}, but uses the
     * `session-cookie-expired` and `session-cookie-revoked` error codes
     * where appropriate.
     *
     * @param sessionCookie - Encoded session cookie to verify.
     * @param checkRevoked - Whether to perform revocation checks based on
     * `tokensValidAfterTime`.
     * @returns A promise resolving to the decoded token, or rejecting with an
     * appropriate auth error.
     */
    verifySessionCookie(sessionCookie: string, checkRevoked?: boolean): Promise<DecodedIdToken>;
    /**
     * Generates a mock password reset link for the given email address.
     *
     * @remarks
     * - `actionCodeSettings` is currently ignored.
     * - The resulting URL is deterministic and suitable for tests that only
     *   need to assert link generation semantics.
     *
     * @param email - Target email address.
     * @param actionCodeSettings - Additional settings (ignored in the mock).
     * @returns A promise resolving to the generated link URL.
     */
    generatePasswordResetLink(email: string, actionCodeSettings?: ActionCodeSettings): Promise<string>;
    /**
     * Generates a mock email verification link for the given email address.
     *
     * @param email - Target email address.
     * @param actionCodeSettings - Additional settings (ignored in the mock).
     * @returns A promise resolving to the generated link URL.
     */
    generateEmailVerificationLink(email: string, actionCodeSettings?: ActionCodeSettings): Promise<string>;
    /**
     * Generates a mock link for verifying and changing a user's email address.
     *
     * @param email - Current email address.
     * @param newEmail - New email address to verify.
     * @param actionCodeSettings - Additional settings (ignored in the mock).
     * @returns A promise resolving to the generated link URL.
     */
    generateVerifyAndChangeEmailLink(email: string, newEmail: string, actionCodeSettings?: ActionCodeSettings): Promise<string>;
    /**
     * Generates a mock sign-in-with-email link.
     *
     * @param email - Target email address.
     * @param actionCodeSettings - Action code settings (ignored in the mock).
     * @returns A promise resolving to the generated link URL.
     */
    generateSignInWithEmailLink(email: string, actionCodeSettings: ActionCodeSettings): Promise<string>;
    /**
     * Lists provider configurations using cursor-based pagination.
     *
     * @remarks
     * - The mock ignores `options.type` and returns all stored provider configs.
     * - `pageToken` is treated as a numeric offset.
     *
     * @param options - Filter and pagination options.
     * @returns A promise resolving to {@link ListProviderConfigResults}.
     */
    listProviderConfigs(options: AuthProviderConfigFilter): Promise<ListProviderConfigResults>;
    /**
     * Retrieves a provider configuration by provider ID.
     *
     * @param providerId - Provider identifier (for example, `"google.com"`).
     * @returns A promise resolving to the provider config, or rejecting with
     * `invalid-provider-id` if not found.
     */
    getProviderConfig(providerId: string): Promise<AuthProviderConfig>;
    /**
     * Deletes a provider configuration by provider ID.
     *
     * @param providerId - Provider identifier of the config to delete.
     * @returns A promise that resolves if the provider config existed and was
     * deleted, or rejects with `invalid-provider-id` otherwise.
     */
    deleteProviderConfig(providerId: string): Promise<void>;
    /**
     * Updates an existing provider configuration.
     *
     * @param providerId - Provider identifier.
     * @param updatedConfig - Partial configuration to merge with the existing
     * config. The provider ID of the stored config is preserved.
     * @returns A promise resolving to the updated {@link AuthProviderConfig},
     * or rejecting with `invalid-provider-id` if no matching config exists.
     */
    updateProviderConfig(providerId: string, updatedConfig: UpdateAuthProviderRequest): Promise<AuthProviderConfig>;
    /**
     * Creates a new provider configuration.
     *
     * @remarks
     * - Fails with `invalid-provider-id` if `providerId` is missing or already
     *   registered.
     *
     * @param config - Complete provider configuration to register.
     * @returns A promise resolving to the stored {@link AuthProviderConfig}.
     */
    createProviderConfig(config: AuthProviderConfig): Promise<AuthProviderConfig>;
    /**
     * Verifies a mock auth-blocking token.
     *
     * @remarks
     * - The `audience` parameter is currently ignored.
     * - The token is decoded via {@link decodeIdToken}, cast to
     *   {@link DecodedAuthBlockingToken}, and normalized with {@link applyToJSON}.
     *
     * @param token - Encoded auth-blocking token.
     * @param audience - Expected audience (ignored in the mock).
     * @returns A promise resolving to the decoded auth-blocking token, or
     * rejecting with `invalid-id-token`.
     */
    _verifyAuthBlockingToken(token: string, audience?: string): Promise<DecodedAuthBlockingToken>;
    /**
     * Gets the provider configuration store for the current tenant,
     * creating it on first use.
     *
     * @returns A mutable map of provider ID to {@link AuthProviderConfig}.
     */
    private providerConfigs;
    /**
     * Finds a user using the provided resolver and returns a {@link UserRecord}.
     *
     * @param resolver - Resolver that describes the predicate and identifying
     * keys used for error reporting.
     * @returns A promise resolving to the matching {@link UserRecord}, or
     * rejecting with `user-not-found` if no user matches the predicate.
     */
    private findUser;
    /**
     * Constructs a deterministic mock action link URL for the given type and
     * query parameters.
     *
     * @param type - Logical link type (for example, `"reset"`, `"signin"`).
     * @param params - Optional query parameters to append to the URL.
     * @returns A deterministic URL string suitable for tests.
     */
    private mockLinkUrl;
}
/**
 * Project-wide mock implementation of `firebase-admin/auth`.
 *
 * @remarks
 * This class represents the default (non-tenant-aware) auth instance, and
 * is analogous to `admin.auth()` in a single-tenant project. Tenant-specific
 * instances can be created via {@link authForTenant}.
 */
export declare class Auth extends BaseAuth {
    /**
     * Creates a new project-wide auth instance.
     *
     * @param tenants - Shared {@link InternalTenantManager} for managing users
     * and provider configs across tenants.
     */
    constructor(tenants: InternalTenantManager<AuthKey>);
    tenantManager(): TenantManager;
    projectConfigManager(): ProjectConfigManager;
}
/**
 * Tenant-specific mock implementation of `firebase-admin/auth`.
 *
 * @remarks
 * Instances of this class are created via {@link Auth.authForTenant} and
 * scope all operations (user CRUD, token verification, provider configs,
 * etc.) to a specific tenant.
 */
export declare class _TenantAwareAuth extends BaseAuth implements Omit<TenantAwareAuth, 'verifyDecodedJWTNotRevokedOrDisabled'> {
    /**
     * Creates a new tenant-aware auth instance.
     *
     * @param tenants - Shared {@link InternalTenantManager}.
     * @param tenantId - Non-empty tenant identifier.
     * @throws {@link Error} if `tenantId` is falsy.
     */
    constructor(tenants: InternalTenantManager<AuthKey>, tenantId: string);
    /**
     * The tenant identifier for this auth instance.
     */
    get tenantId(): string;
}
//# sourceMappingURL=auth.d.ts.map