/** The user Sync Server reports alongside an app token. */
export interface SyncUser {
    id: string;
    name?: string | null;
    email?: string | null;
    image?: string | null;
}
/** A signed-in session: a short-lived bearer token plus who it belongs to. */
export interface AuthSession {
    /** Signed JWT app token. Send as `Authorization: Bearer` or `?token=`. */
    token: string;
    /** Expiry in epoch **milliseconds**. */
    expires: number;
    user: SyncUser;
}
/** Where to persist the session between page loads. */
export type StorageKind = 'local' | 'session' | 'memory';
export interface PopupOptions {
    /** Popup width in px. Default 520. */
    width?: number;
    /** Popup height in px. Default 640. */
    height?: number;
    /** `window.open` target name. Default `imaps-sync-auth`. */
    name?: string;
}
/**
 * How `signIn()` reaches the sign-in page.
 * - `'auto'` (default): popup, falling back to a full-page redirect when the popup is blocked.
 * - `'popup'`: popup only; rejects with `popup-blocked` when it cannot open.
 * - `'redirect'`: always navigate the current window; the promise never settles because the page unloads.
 */
export type SignInMode = 'auto' | 'popup' | 'redirect';
export interface SignInOptions {
    mode?: SignInMode;
    /**
     * Where the redirect flow (and a magic link opened in another tab) should
     * bring the user back to, with the token in the URL fragment. Defaults to the
     * current page URL. Its origin must be on the server's redirect allow-list.
     */
    returnTo?: string;
}
export interface SyncAuthOptions {
    /** Sync Server origin, e.g. `https://sync.example.com`. */
    server: string;
    /**
     * Persistence for the session. `'local'` (default) survives reloads and tabs,
     * `'session'` survives reloads in one tab, `'memory'` never touches storage.
     * Pass any `Storage`-like object to bring your own.
     */
    storage?: StorageKind | Storage;
    /** Storage key. Default `imaps:sync-auth`. */
    storageKey?: string;
    popup?: PopupOptions;
    /** Default `signIn()` mode. See `SignInMode`. Default `'auto'`. */
    mode?: SignInMode;
    /** Default `returnTo` for the redirect flow. Default: the current page URL. */
    returnTo?: string;
    /**
     * When the ArcGIS Maps SDK is loaded from the CDN (`$arcgis.import` exists),
     * register the token with IdentityManager and intercept requests automatically.
     * Default true. Bundler apps use `@imaps/sync-server-auth/arcgis` instead.
     */
    arcgis?: boolean;
}
/** @internal Message shape posted by the server's popup-complete page. */
export type AuthPopupMessage = ({
    type: 'imaps:auth';
} & AuthSession) | {
    type: 'imaps:auth:error';
    error?: string;
};
export type SignInErrorCode = 'popup-blocked' | 'cancelled' | 'server-error' | 'invalid-response' | 'not-signed-in' | 'redirecting';
/** Thrown by `signIn()` and friends. Branch on `code` rather than the message. */
export declare class SignInError extends Error {
    readonly code: SignInErrorCode;
    readonly name = "SignInError";
    constructor(code: SignInErrorCode, message: string, options?: ErrorOptions);
}
/** @internal HTTP statuses that mean "the token is no longer good". 499 is ArcGIS's "Token Required". */
export declare const AUTH_FAILURE_STATUSES: ReadonlySet<number>;
//# sourceMappingURL=types.d.ts.map