import { AuthChangeEvent, AuthSession, AuthUser, LastLogin, OAuthProvider, OAuthResumeCheckout, OtpVerifyType, SignUpResult } from '@monetize.software/sdk';
import { TransportClient } from '../shared/transport-client';
export type AuthChangeListener = (event: AuthChangeEvent, session: AuthSession | null) => void;
export interface RemoteAuthClientOptions {
    paywallId: string;
    apiOrigin?: string;
}
export declare class RemoteAuthClient {
    private readonly transport;
    readonly paywallId: string;
    readonly apiOrigin: string | undefined;
    private session;
    private listeners;
    private unsubBroadcast;
    private hydrated;
    constructor(transport: TransportClient, opts: RemoteAuthClientOptions);
    /** A promise that resolves after the initial session sync from offscreen.
     *  The analog of AuthClient.ready(). */
    ready(): Promise<void>;
    getCachedSession(): AuthSession | null;
    getCachedUser(): AuthUser | null;
    onAuthChange(cb: AuthChangeListener): () => void;
    signInWithEmail(input: {
        email: string;
        password: string;
    }): Promise<AuthSession>;
    signUp(input: {
        email: string;
        password: string;
        userMeta?: Record<string, string>;
    }): Promise<SignUpResult>;
    signOut(): Promise<void>;
    refresh(): Promise<AuthSession | null>;
    sendOtp(input: {
        email: string;
        createUser?: boolean;
        userMeta?: Record<string, unknown>;
    }): Promise<void>;
    verifyOtp(input: {
        email: string;
        token: string;
        type: OtpVerifyType;
    }): Promise<AuthSession>;
    resendConfirmation(input: {
        email: string;
    }): Promise<void>;
    requestPasswordReset(input: {
        email: string;
    }): Promise<void>;
    updatePassword(input: {
        password: string;
    }): Promise<void>;
    revokeAllSessions(): Promise<void>;
    /** Last-used auth method + email — read from offscreen storage. AuthPanel uses
     *  it for the "Last used" badge and email pre-fill. Storage is paywall-scoped,
     *  and offscreen is the single source of truth for all tabs/popups. */
    getLastLogin(): Promise<LastLogin | null>;
    /** Anonymous sign-in (a Supabase user without an email). The logic (an
     *  idempotent check + resume via a stored refresh_token + fresh signin) lives
     *  in the offscreen AuthClient — content only proxies. captchaToken and
     *  forceNewAnon are pass-through for forward-compat / the switch-account flow. */
    signInAnonymously(input?: {
        captchaToken?: string;
        userMeta?: Record<string, string>;
        forceNewAnon?: boolean;
    }): Promise<AuthSession>;
    /** The current access token (lazily refreshable in offscreen). content/popup
     *  uses it for the Bearer in external fetches — the ApiGatewayClient in the
     *  content-script, direct requests from the demo UI. null if signed out or the
     *  offscreen AuthClient couldn't refresh. */
    getAccessToken(): Promise<string | null>;
    /** OAuth via the web variant: window.open in the content-script, a provider
     *  redirect, and the callback page posts the code back to the opener. Under
     *  the hood it's a split into two requests to offscreen — startOAuthFlow (hit
     *  /init, get authorize_url) → open the popup → waitForOAuthCode → exchange.
     *
     *  The PKCE verifier lives ONLY in offscreen (inside the AuthClient) and never
     *  crosses the runtime boundary. Content gets only authorize_url and state.
     *
     *  Popup gesture: `window.open(authorize_url, ...)` runs in the same synchronous
     *  flow as the startOAuthFlow response; the user-gesture is preserved because
     *  the content-script isn't unloaded within that tick (the gesture survives
     *  through all microtasks of a single call stack). If in some browser the
     *  gesture is lost anyway — the host gets `popup_blocked` (the same as in @monetize.software/sdk).
     */
    signInWithOAuth(input: {
        provider: OAuthProvider;
        scopes?: string;
        userMeta?: Record<string, string>;
        onPopupOpened?: () => void;
        /** Force a plain signin (no anon-upgrade linkIdentity) into the account that
         *  owns the identity. Passed by the UI "sign in with that account" button. */
        switchAccount?: boolean;
        /** Purchase to continue with after signing in. Unlike the plain SDK, this is
         *  acted upon: offscreen creates the checkout and the service worker sends
         *  the provider tab straight there, so the flow completes even though this
         *  surface is gone by then. */
        resumeCheckout?: OAuthResumeCheckout;
    }): Promise<AuthSession>;
    /** The session offscreen holds now, if it represents a sign-in that happened
     *  during this flow rather than whatever we started with. Returns null when
     *  nothing changed, i.e. the window really was closed by the user.
     *
     *  Compared by identity, not by token: a routine background refresh also
     *  rotates the token, and mistaking that for a completed sign-in would swallow
     *  a genuine cancellation. A signed-in user re-linking another provider is
     *  therefore not detected here and still reports cancelled — the conservative
     *  side of the trade. */
    private adoptedSessionSince;
    destroy(): void;
    private applySession;
}
//# sourceMappingURL=RemoteAuthClient.d.ts.map