import type { Unsubscribe, User } from './types.js';
export type AuthProvider = 'github' | 'google' | 'apple' | 'email';
/** OAuth authentication — sign in, sign out, session management. */
export declare class Auth {
    private readonly appId;
    private readonly apiBase;
    private session;
    private listeners;
    constructor(appId: string, apiBase: string);
    /** Current signed-in user, or null if not authenticated. */
    get user(): User | null;
    /** Current session token, or null if not authenticated. */
    get token(): string | null;
    /** Subscribe to auth state changes. Fires immediately with current user, then on every change. */
    onChange(listener: (user: User | null) => void): Unsubscribe;
    /**
     * Redirect-based GitHub OAuth. Opens the platform's hosted OAuth start URL,
     * which redirects back to the current page with a session token in the hash.
     *
     * The current page's `location.hash` is dropped from `return_to` because
     * the OAuth callback writes its own `#fas_session=…` and would clobber any
     * hash-based router state otherwise.
     */
    signIn(provider?: AuthProvider): void;
    /**
     * Email magic-link sign-in. Sends the user an email with a one-time link
     * that completes auth and redirects back here with `#fas_session=…`.
     *
     * Resolves once the email has been queued. The caller should show a
     * "check your inbox" message — the actual sign-in happens later when
     * the user clicks the link.
     *
     * Throws on validation or server errors. Resolves with `{ ok: true }`
     * regardless of whether the email is already registered (no account-
     * enumeration leak).
     */
    signInWithEmail(email: string): Promise<void>;
    /** Clear the session and notify listeners. */
    signOut(): void;
    /**
     * @internal Called by Kv and ApiProxy on 401 responses.
     * Clears the stale session so the UI reacts immediately.
     * Do not call directly — use `signOut()` instead.
     */
    handleUnauthorized(): void;
    /**
     * Permanently delete the signed-in account and its personal data on the
     * server (API keys, KV, friendships, roles, owned documents, logs), then
     * sign out locally. Throws if the server call fails, so a "delete account"
     * button can surface the error instead of falsely reporting success.
     *
     * Not deleted: apps you own (deprovision those separately). Note: the current
     * session token stays valid until it expires; there is no server-side token
     * revocation yet.
     */
    deleteAccount(): Promise<void>;
    /**
     * Call this once at app start, before rendering anything that depends on
     * auth state. If the page was loaded via an auth callback (e.g. after
     * `signIn()` returned from GitHub), this captures the session from the
     * URL hash, persists it to localStorage, and clears the hash. On a normal
     * page load it's a no-op — the constructor already restored any cached
     * session from localStorage.
     *
     * @example
     *   const fas = initApp({ appId: 'my-app' });
     *   await fas.auth.init();
     *   render();
     */
    init(): Promise<void>;
    /**
     * Set the user's platform-level date of birth. Set-once: throws if it's
     * already set (status 409 from the backend) or if age < 13. After success
     * the cached user is updated and listeners are notified.
     *
     * @param dateOfBirth ISO 'YYYY-MM-DD' string.
     */
    setDateOfBirth(dateOfBirth: string): Promise<User>;
    private fetchUser;
    /** Fire-and-forget: ensure the user has at least 'member' role in this app. */
    private ensureMember;
    private readStorage;
    private writeStorage;
    private emit;
}
//# sourceMappingURL=auth.d.ts.map