import { User, AuthTokens, LoginCredentials, RegisterCredentials } from './types';
/**
 * Initializes the session security by generating a fresh encryption key.
 *
 * SECURITY: This function should be called during application initialization
 * or when a new authentication session begins. The generated key is stored
 * only in memory and is not predictable.
 *
 * @returns The generated encryption key (for use during session)
 */
export declare function initializeSessionSecurity(): string;
/**
 * Low-level token handling with secure encrypted storage.
 *
 * SECURITY IMPROVEMENTS:
 * - Tokens are now encrypted at rest using AES-GCM via SecureStorage
 * - PBKDF2 key derivation with configurable iterations
 * - Integrity verification via checksums
 * - All token operations are now async for proper crypto handling
 * - Rate limiting with exponential backoff for failed auth attempts
 * - Cryptographically secure session key generation
 *
 * @see {@link SecureStorage} for encryption implementation details
 */
declare class AuthService {
    private refreshPromise;
    private secureStorage;
    /**
     * In-memory cache for tokens to support synchronous access patterns.
     * This cache is populated on initialization and updated on token changes.
     *
     * SECURITY NOTE: In-memory cache is cleared on page reload and is not
     * accessible to other scripts due to JavaScript's memory isolation.
     */
    private tokenCache;
    /**
     * Rate limiting state for authentication attempts.
     *
     * SECURITY: Stored in memory only, resets on page reload.
     * This prevents brute force attacks during a single session.
     */
    private rateLimitState;
    constructor();
    /**
     * Checks if the user is currently rate limited.
     *
     * SECURITY: Returns true if too many failed attempts have occurred.
     *
     * @returns Object containing rate limit status and remaining time
     */
    checkRateLimit(): {
        isLimited: boolean;
        retryAfterMs: number;
        attemptsRemaining: number;
    };
    /**
     * Initialize the auth service by loading tokens from secure storage.
     * This should be called once during app initialization.
     *
     * SECURITY: Also initializes session encryption key if not already done.
     *
     * @returns Promise that resolves when initialization is complete
     */
    initialize(): Promise<void>;
    /**
     * Login with credentials using apiClient.
     *
     * SECURITY: Implements rate limiting with exponential backoff to prevent
     * brute force attacks. If too many failed attempts occur, the user will
     * be temporarily locked out.
     *
     * @throws {ApiError} When authentication fails
     * @throws {Error} When rate limited
     */
    login(credentials: LoginCredentials): Promise<{
        user: User;
        tokens: AuthTokens;
    }>;
    /**
     * Register a new user using apiClient
     * @throws {ApiError} When registration fails
     */
    register(credentials: RegisterCredentials): Promise<{
        user: User;
        tokens: AuthTokens;
    }>;
    /**
     * Logout the current user using apiClient.
     * Securely clears all tokens from encrypted storage and memory cache.
     */
    logout(): Promise<void>;
    /**
     * Refresh the access token using apiClient
     * @throws {ApiError} When token refresh fails
     */
    refreshTokens(): Promise<AuthTokens>;
    /**
     * Get the current user profile using apiClient
     * @throws {ApiError} When fetching user profile fails
     */
    getCurrentUser(): Promise<User>;
    /**
     * Check if the user is authenticated (has valid tokens).
     * Uses in-memory cache for synchronous access.
     */
    isAuthenticated(): boolean;
    /**
     * Get the access token from in-memory cache.
     *
     * SECURITY: Returns cached value for synchronous access.
     * The actual token is stored encrypted in SecureStorage.
     */
    getAccessToken(): string | null;
    /**
     * Get the refresh token from in-memory cache.
     *
     * SECURITY: Returns cached value for synchronous access.
     * The actual token is stored encrypted in SecureStorage.
     */
    getRefreshToken(): string | null;
    /**
     * Get token expiry timestamp from in-memory cache.
     */
    getTokenExpiry(): number | null;
    /**
     * Retrieve access token asynchronously from secure storage.
     * Use this when you need the freshest value from encrypted storage.
     *
     * SECURITY: Uses session-keyed encrypted storage.
     *
     * @returns Promise resolving to the access token or null
     */
    getAccessTokenAsync(): Promise<string | null>;
    /**
     * Retrieve refresh token asynchronously from secure storage.
     * Use this when you need the freshest value from encrypted storage.
     *
     * SECURITY: Uses session-keyed encrypted storage.
     *
     * @returns Promise resolving to the refresh token or null
     */
    getRefreshTokenAsync(): Promise<string | null>;
    /**
     * Gets the secure storage instance, initializing with session key if needed.
     *
     * SECURITY: Uses cryptographically secure session key for encryption.
     */
    private getSecureStorage;
    /**
     * Records a failed authentication attempt and applies rate limiting.
     *
     * SECURITY: Implements exponential backoff to slow down brute force attacks.
     */
    private recordFailedAttempt;
    /**
     * Resets the rate limiting state after successful authentication.
     *
     * SECURITY: Called after successful login to clear failed attempt counter.
     */
    private resetRateLimit;
    /**
     * Load tokens from secure storage into memory cache.
     * This enables synchronous access for performance-critical paths.
     *
     * SECURITY: Uses lazily-initialized secure storage with session key.
     */
    private loadTokensToCache;
    /**
     * Store tokens in encrypted secure storage.
     *
     * SECURITY: Tokens are encrypted using AES-GCM before storage.
     * The encryption key is derived using PBKDF2 with a high iteration count.
     * Each token storage operation uses a unique IV for encryption.
     * Session key is cryptographically random and stored only in memory.
     *
     * @param tokens - The auth tokens to store securely
     */
    private storeTokens;
    /**
     * Clear tokens from encrypted storage and memory cache.
     *
     * SECURITY: This method ensures tokens are removed from both
     * the encrypted storage and the in-memory cache to prevent
     * any token leakage after logout.
     */
    private clearTokens;
}
export declare const authService: AuthService;
export {};