/**
 * Authentication Service
 *
 * Handles user authentication (email/password and OAuth),
 * session persistence, and token management.
 *
 * Session tokens are encrypted at rest using AES-256-GCM with
 * a machine-derived encryption key.
 */
import type { AuthSession, LoginCredentials, LoginResult, Tier, User } from '../types/auth.js';
export declare class AuthService {
    private apiUrl;
    private session;
    private expiredSession;
    constructor(apiUrl?: string);
    private ensureAuthDir;
    /** Load last known server time from disk */
    private loadLastServerTime;
    /** Save server time (only moves forward) */
    private saveLastServerTime;
    /** Update stored server time from API response Date header */
    updateServerTime(dateHeader: string): void;
    /** Get the effective "now" time, using max of local clock and last server time */
    private getEffectiveNow;
    /**
     * Encrypt a session for storage
     */
    private encryptSession;
    /**
     * Decrypt an encrypted session file
     */
    private decryptSession;
    private loadSession;
    private saveSession;
    private clearSession;
    login(credentials: LoginCredentials): Promise<LoginResult>;
    /**
     * Complete 2FA login by verifying a TOTP code against the challenge token.
     */
    verify2FA(challengeToken: string, code: string): Promise<AuthSession>;
    logout(): Promise<void>;
    refreshSession(): Promise<AuthSession | null>;
    /**
     * Attempt to refresh an expired session on startup.
     * If the server accepts the token, the session is restored and extended.
     * If the token is truly expired/revoked, the session is cleared permanently.
     */
    tryRefreshExpiredSession(): Promise<boolean>;
    hasPendingRefresh(): boolean;
    getSession(): AuthSession | null;
    isAuthenticated(): boolean;
    getUser(): User | null;
    getTier(): Tier;
    hasPlusDiscount(): boolean;
    getToken(): string | null;
    /**
     * Check if the user's subscription tier has expired based on cached expiry timestamp.
     * Returns true if tierExpiresAt is set and has passed.
     */
    isTierExpired(): boolean;
    /**
     * Get the user's effective tier, accounting for offline expiry.
     * If the cached tier has expired, falls back to plus (if hasPlusDiscount) or free.
     */
    getEffectiveTier(): Tier;
    /**
     * Login using a Personal Access Token (PAT) for headless servers.
     * Validates the token against the API and creates a local session.
     */
    loginWithToken(token: string): Promise<AuthSession>;
    loginWithOAuth(provider: 'google' | 'github', signal?: AbortSignal, onUrl?: (url: string) => void): Promise<void>;
    private openBrowser;
    /**
     * OAuth callback ports tried in order. Falls back if 9876 is occupied (e.g.
     * a previous CLI session crashed without releasing it, or two CLIs are
     * running concurrently). The OAuth provider's redirect_uri must match the
     * port we end up bound to, so the actual port is returned to the caller.
     *
     * Phase 3 security audit, finding P0 #7 (April 30, 2026).
     */
    private static readonly OAUTH_PORT_RANGE;
    private startCallbackServer;
    private bindCallbackServerOnPort;
    isFirstLaunch(): boolean;
    markFirstLaunchSeen(): void;
    wasFirstLaunchSeen(): boolean;
}
export declare function getAuthService(): AuthService;
//# sourceMappingURL=auth-service.d.ts.map