import { H as HttpClientOptions$1, a as HttpClient$1, T as TokenManager$1, S as Session$1 } from './index.d-CS4ceNwT.cjs';
import { S as SessionStorageAdapter } from './storage-Nj6JAWej.cjs';
import { F } from './pooled-flags-ByrxSmnn.js';

declare class PalbaseError extends Error {
    readonly code: string;
    readonly status: number;
    readonly details?: unknown;
    constructor(code: string, message: string, status: number, details?: unknown);
}

interface PalbaseResponse<T> {
    data: T | null;
    error: PalbaseError | null;
    count?: number;
    status: number;
    /**
     * The response's `ETag`, when it carried one.
     *
     * Lifted out of the header bag for the same reason `count` is (it comes from
     * `Content-Range`): a caller doing conditional requests needs exactly this
     * one value, and the validator it must echo is the SERVER's — not something
     * the caller can reconstruct. Offering a validator of one's own invention is
     * how a conditional request quietly stops being conditional: measured on
     * centauri 2026-09-11, where the flags poll sent `If-None-Match: 0` against
     * an `etag: "15-e0e4f431743eb0c5"` and so could never once be answered 304.
     */
    etag?: string;
}
interface HttpClientOptions {
    /**
     * Auth requests are sealed automatically. Self-hosted stacks can pin their
     * own base64 Ed25519 root. `false` is an explicit opt-out for test servers or
     * older self-hosted stacks; it cannot satisfy a server requiring sealing.
     */
    sealed?: {
        root?: string;
        stackRef?: string;
    } | false;
    /**
     * The host application's own version, sent as `X-Palbase-Client-Version` and
     * readable in flag targeting as `client.app_version`.
     *
     * Opt-in because the SDK cannot discover it on the web — there is no bundle
     * to read a version out of. iOS fills the same header automatically from
     * CFBundleShortVersionString.
     */
    appVersion?: string;
    url?: string;
    headers?: Record<string, string>;
}
interface RequestOptions {
    headers?: Record<string, string>;
    body?: unknown;
    signal?: AbortSignal;
    /** Disable network/429 replay for one-time exchanges. Protocol retries remain bounded. */
    retry?: boolean;
    /** Credential/token exchanges must not refresh an unrelated or expired bearer first. */
    skipSessionRefresh?: boolean;
}
interface Session {
    accessToken: string;
    refreshToken: string;
    expiresAt: number;
}
type AuthStateEvent = 'SESSION_SET' | 'SESSION_CLEARED';
type AuthStateCallback = (event: AuthStateEvent, session: Session | null) => void;
type Unsubscribe$2 = () => void;

declare class TokenManager {
    private session;
    private listeners;
    private refreshPromise;
    private refreshing;
    refreshFunction: ((refreshToken: string) => Promise<Session>) | null;
    setSession(session: Session): void;
    getAccessToken(): string | null;
    getRefreshToken(): string | null;
    clearSession(): void;
    isExpired(): boolean;
    refreshSession(): Promise<void>;
    onAuthStateChange(callback: AuthStateCallback): Unsubscribe$2;
    private executeRefresh;
    private notify;
}

/**
 * Request interceptor. Runs before every HTTP request.
 * Can modify headers, body, or reject the request.
 */
type RequestInterceptor = (request: {
    headers: Record<string, string>;
    method: string;
    path: string;
}) => void | Promise<void>;
declare class HttpClient {
    protected readonly apiKey: string;
    protected readonly options?: HttpClientOptions;
    tokenManager: TokenManager | null;
    /**
     * Admin JWT used for platform admin endpoints (/admin/*).
     * When set, takes precedence over tokenManager access token in the
     * Authorization header.
     */
    adminToken: string | null;
    private readonly interceptors;
    private readonly forbiddenListeners;
    private sealedKeys?;
    constructor(apiKey: string, options?: HttpClientOptions);
    /** Set (or clear) the admin JWT used on admin endpoints. */
    setAdminToken(token: string | null): void;
    /**
     * Called with the RAW body of every 403 this client receives (FR-010). Core
     * does not know the envelope's fields — the layer that does (palbe) reads
     * `required` out of it. Nothing is retried or swallowed: the error still
     * returns to the caller.
     */
    onForbidden(handler: (body: Record<string, unknown>) => void): () => void;
    /**
     * Create a scoped HttpClient that adds the given extra headers to every
     * request. The returned client shares the admin token and token manager
     * with the parent at runtime — later changes on the parent propagate to
     * the scope and vice versa.
     *
     * Typical use: adding an Environment-routing header for an admin call.
     */
    withHeaders(extra: Record<string, string>): HttpClient;
    /** Add a request interceptor. Runs before every request. */
    addInterceptor(interceptor: RequestInterceptor): void;
    request<T>(method: string, path: string, options?: RequestOptions): Promise<PalbaseResponse<T>>;
    /**
     * A response read as it arrives, for `text/event-stream` routes.
     *
     * Deliberately NOT `executeWithRetry`: a retry replays the request, and a
     * stream the caller has already begun reading cannot be replayed — the frames
     * it handed over would arrive a second time. A stream that fails to open fails
     * to the caller, once, with its status.
     *
     * The buffered path's headers, base URL and interceptors are reused verbatim,
     * so a streaming call is authenticated exactly like every other call; only the
     * body handling differs. `Accept` says what the caller wants, and the status
     * is returned beside the body because the CALLER decides what a non-2xx means
     * (an error envelope arrives as an ordinary buffered body).
     */
    requestStream(method: string, path: string, options?: RequestOptions): Promise<{
        status: number;
        body: ReadableStream<Uint8Array> | null;
        contentType: string;
    }>;
    private prepareSealed;
    private getBaseUrl;
    private buildHeaders;
    private executeWithRetry;
    private delay;
}

interface User {
    id: string;
    email: string;
    emailVerified: boolean;
    createdAt: string;
    updatedAt: string;
    metadata?: Record<string, unknown>;
    /**
     * The caller's APPLICATION roles, as assigned in `auth.user_roles`.
     *
     * Empty array for a caller who holds none, never undefined — a UI hint, not
     * the boundary: the server decides, and it decides again on every request.
     */
    roles: string[];
}
interface TokenResponse {
    access_token: string;
    refresh_token: string;
    token_type: string;
    expires_in: number;
}
interface AuthSession {
    id: string;
    ip?: string;
    user_agent?: string;
    acr: string;
    amr: string[];
    last_activity: string;
    created_at: string;
    current: boolean;
}
interface SignUpCredentials {
    email: string;
    password: string;
    /**
     * The language the account's mail is written in (BCP 47, e.g. `"tr"`), as an
     * explicit choice: it is STORED on the user and wins over the device's
     * language from then on. Omitted, the stack uses the request's language for
     * each mail and then its default — nothing is stored.
     */
    locale?: string;
}
interface SignInCredentials {
    email: string;
    password: string;
}
interface VerifyEmailParams {
    token?: string;
    code?: string;
    email?: string;
}
interface PasswordResetParams {
    email: string;
}
interface PasswordResetConfirmParams {
    token: string;
    new_password: string;
}
interface PasswordChangeParams {
    current_password: string;
    new_password: string;
}
/**
 * Body of POST /auth/password/set — a passwordless account's FIRST password.
 *
 * No current password on purpose: the accounts this serves (passkey-first,
 * social-only) do not have one, which is why `changePassword` answers them 401.
 */
interface PasswordSetParams {
    new_password: string;
}
interface MFAEnrollParams {
    type: 'totp' | 'email';
}
interface MFAEnrollResult {
    enrollment_id?: string;
    secret?: string;
    otp_url?: string;
    qr_code?: string;
    recovery_codes?: string[];
    status?: string;
}
interface MFAChallengeParams {
    mfa_token: string;
    type: 'totp' | 'email';
    code: string;
}
interface MFARecoveryParams {
    mfa_token: string;
    code: string;
}
interface MFAFactor {
    id: string;
    type: string;
    verified: boolean;
    created_at: string;
}
interface MFAEmailChallengeParams {
    mfa_token: string;
}
interface MFAEmailVerifyParams {
    mfa_token: string;
    code: string;
}
interface Identity {
    id: string;
    provider: string;
    provider_user_id: string;
    created_at: string;
}
interface MagicLinkParams {
    email: string;
}
interface MagicLinkVerifyParams {
    token: string;
    fingerprint_hash?: string;
}
interface RegisterTrustedDeviceParams {
    fingerprint_hash: string;
    device_name?: string;
}
interface TrustedDevice {
    id: string;
    device_name?: string;
    created_at: string;
    last_used_at: string;
    expires_at: string;
}
interface DeviceInfo {
    id: string;
    platform: string;
    attestation_status: string;
    bound: boolean;
    created_at: string;
}
interface AttestAndroidParams {
    verdict_token: string;
}
interface AttestAndroidResult {
    device_id: string;
    attestation_status: string;
    device_integrity?: string;
}
interface AttestiOSParams {
    attestation_object: string;
    key_id: string;
    challenge: string;
}
interface AttestiOSResult {
    device_id: string;
    attestation_status: string;
}
interface BindDeviceParams {
    device_id: string;
    public_key: string;
    platform_attestation?: string;
}
interface VerifyRequestSignatureParams {
    payload: string;
    signature: string;
}
type AuthEvent = 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED';
type AuthStateChangeCallback = (event: AuthEvent, session: Session | null) => void;

/**
 * Device attestation client.
 * Handles device challenge/attestation/bind and App Check JWT cache.
 */
declare class DeviceClient {
    private readonly httpClient;
    private cachedToken;
    private refreshTimer;
    constructor(httpClient: HttpClient);
    /** Generate a device attestation challenge. */
    generateChallenge(): Promise<PalbaseResponse<{
        challenge: string;
    }>>;
    /** Attest an Android device with a Play Integrity verdict token. */
    attestAndroid(params: AttestAndroidParams): Promise<PalbaseResponse<AttestAndroidResult>>;
    /** Attest an iOS device with App Attest attestation data. */
    attestiOS(params: AttestiOSParams): Promise<PalbaseResponse<AttestiOSResult>>;
    /** Bind a verified device with a public key for request signing. */
    bind(params: BindDeviceParams): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    /** List all devices for the current user. */
    list(): Promise<PalbaseResponse<{
        devices: DeviceInfo[];
    }>>;
    /** Delete a device by ID. */
    delete(deviceId: string): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    /**
     * Verify a request signature from a device (server-only).
     * Should NOT be exposed in client SDK.
     */
    verifyRequestSignature(deviceId: string, params: VerifyRequestSignatureParams): Promise<PalbaseResponse<{
        verified: boolean;
    }>>;
    /** Get the cached App Check token, or null if not available / expired. */
    getToken(): string | null;
    /** Whether App Check is active (token cached and not expired). */
    get isActive(): boolean;
    /** Set a cached App Check token manually (e.g. after attest flow). */
    setCachedToken(token: string, expiresInMs: number): void;
    /** Clean up timers and cached state. */
    dispose(): void;
    private scheduleRefresh;
}

type OAuthProvider = 'google' | 'apple' | 'microsoft' | 'github';
type OAuthPurpose = 'sign_in' | 'link';
interface OAuthConfig {
    contract_revision: 1;
    config_revision: string;
    environment_ref: string;
    application_key: string;
    platform: 'web';
    variant: string;
    clients: Array<{
        key: string;
        provider: OAuthProvider;
        mode: 'browser';
        return_uris: string[];
    }>;
}
interface OAuthOptions {
    provider: OAuthProvider;
    redirectTo?: string;
    purpose?: OAuthPurpose;
}
interface OAuthTransaction {
    id: string;
    clientKey: string;
    provider: OAuthProvider;
    purpose: OAuthPurpose;
    expiresAt: string;
    authorizationURL: string;
}
type OAuthResult = {
    status: 'signedIn';
    user: User;
    session: Session;
    isNewUser: boolean;
} | {
    status: 'mfaRequired';
    mfaToken: string;
    factors: string[];
} | {
    status: 'linked';
    identity: Identity;
    userId: string;
};
/** Per-transaction proof storage. A failed write must reject; never fall back to memory. */
interface OAuthTransactionStorage {
    load(key: string): string | null | Promise<string | null>;
    save(key: string, value: string, expiresAt: string): void | Promise<void>;
    remove(key: string): void | Promise<void>;
}

interface AuthClientOptions {
    oauth?: OAuthConfig;
    oauthStorage?: OAuthTransactionStorage;
    /** Coordinate rotating credentials with the runtime's shared session store. */
    coordinateRefresh?: (refreshToken: string, exchange: (refreshToken: string) => Promise<Session>) => Promise<Session>;
}
declare class AuthClient {
    private readonly httpClient;
    private readonly tokenManager;
    private readonly apiKey;
    private readonly baseUrl;
    private currentSession;
    private hasSession;
    private _mfa;
    private readonly oauthFlow;
    private readonly coordinateRefresh;
    /** Device attestation */
    readonly device: DeviceClient;
    constructor(httpClient: HttpClient, tokenManager: TokenManager, apiKey?: string, baseUrl?: string, options?: AuthClientOptions);
    signUp(credentials: SignUpCredentials, options?: {
        headers?: Record<string, string>;
    }): Promise<PalbaseResponse<{
        user: User;
        session: Session;
    }>>;
    signIn(credentials: SignInCredentials): Promise<PalbaseResponse<{
        user: User;
        session: Session;
    }>>;
    signOut(): Promise<PalbaseResponse<void>>;
    verifyEmail(params: VerifyEmailParams): Promise<PalbaseResponse<{
        status: string;
    }>>;
    resendVerification(email: string): Promise<PalbaseResponse<{
        verification_token?: string;
        verification_code?: string;
    }>>;
    requestPasswordReset(params: PasswordResetParams): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    confirmPasswordReset(params: PasswordResetConfirmParams): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    changePassword(params: PasswordChangeParams): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    /**
     * Give a PASSWORDLESS account its first password.
     *
     * Separate from `changePassword` because that one cannot serve the case: it
     * sends a current password and palauth answers an account that has none with
     * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
     * the same gate passkey enrollment carries); an account that already has a
     * password gets 409 `password_already_set`.
     */
    setPassword(params: PasswordSetParams): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    refresh(): Promise<PalbaseResponse<TokenResponse>>;
    getAccessToken(): string | null;
    onTokenChange(callback: (tokens: {
        accessToken: string | null;
        refreshToken: string | null;
    }) => void): () => void;
    setTokens(accessToken: string, refreshToken: string, expiresIn?: number): void;
    listSessions(): Promise<PalbaseResponse<AuthSession[]>>;
    revokeSession(sessionId: string): Promise<PalbaseResponse<void>>;
    revokeAllSessions(): Promise<PalbaseResponse<void>>;
    get mfa(): {
        enroll: (params: MFAEnrollParams) => Promise<PalbaseResponse<MFAEnrollResult>>;
        verifyEnrollment: (code: string) => Promise<PalbaseResponse<{
            status: string;
        }>>;
        challenge: (params: MFAChallengeParams) => Promise<PalbaseResponse<TokenResponse>>;
        recovery: (params: MFARecoveryParams) => Promise<PalbaseResponse<TokenResponse>>;
        listFactors: () => Promise<PalbaseResponse<{
            factors: MFAFactor[];
        }>>;
        removeFactor: (factorId: string, currentPassword: string) => Promise<PalbaseResponse<{
            status: string;
        }>>;
        regenerateRecoveryCodes: () => Promise<PalbaseResponse<{
            recovery_codes: string[];
        }>>;
        emailEnroll: () => Promise<PalbaseResponse<{
            status: string;
        }>>;
        emailChallenge: (params: MFAEmailChallengeParams) => Promise<PalbaseResponse<{
            status: string;
        }>>;
        emailVerify: (params: MFAEmailVerifyParams) => Promise<PalbaseResponse<TokenResponse>>;
    };
    private buildMfa;
    getOAuthURL(options: OAuthOptions): Promise<PalbaseResponse<{
        url: string;
    }>>;
    beginOAuth(options: OAuthOptions): Promise<PalbaseResponse<OAuthTransaction>>;
    completeOAuth(params: {
        transactionId: string;
        resultCode?: string;
        callbackURL?: string;
    }): Promise<PalbaseResponse<OAuthResult>>;
    cancelOAuth(transactionId: string): Promise<PalbaseResponse<void>>;
    listIdentities(): Promise<PalbaseResponse<{
        identities: Identity[];
    }>>;
    linkIdentity(options: Omit<OAuthOptions, 'purpose'>): Promise<PalbaseResponse<OAuthTransaction>>;
    unlinkIdentity(identityId: string): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    requestMagicLink(params: MagicLinkParams): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    verifyMagicLink(params: MagicLinkVerifyParams): Promise<PalbaseResponse<{
        user: User;
        session: Session;
    }>>;
    listTrustedDevices(): Promise<PalbaseResponse<{
        trusted_devices: TrustedDevice[];
    }>>;
    registerTrustedDevice(params: RegisterTrustedDeviceParams): Promise<PalbaseResponse<{
        trusted_device_token: string;
    }>>;
    revokeTrustedDevice(deviceId: string): Promise<PalbaseResponse<{
        success: boolean;
    }>>;
    getSession(): {
        data: Session | null;
        error: null;
    };
    onAuthStateChange(callback: AuthStateChangeCallback): {
        data: {
            subscription: {
                unsubscribe: () => void;
            };
        };
    };
    /**
     * Verify a user's JWT token by calling GET /auth/user with their token.
     * Server-only — should NOT be exposed in client SDK.
     */
    verifyUserToken(jwt: string): Promise<PalbaseResponse<User>>;
    private setSessionAndWireRefresh;
    private refreshToken;
    private requestRefresh;
}

type CallState = 'connecting' | 'active' | 'ended';
interface CallParticipant {
    identity: string;
    isSpeaking: boolean;
    audioMuted: boolean;
    videoEnabled: boolean;
    /** The live <video> element for this participant, or null before track arrives. */
    videoElement: HTMLVideoElement | null;
    /** The live <audio> element for this participant, or null before track arrives. */
    audioElement: HTMLAudioElement | null;
}
type CallChangeCallback = (call: Call) => void;
/**
 * A live call session. Obtain via `pb.calls.start()` or `pb.calls.accept()`.
 *
 * Lifecycle:
 *   connecting → active (room joined, tracks flowing)
 *   active → ended   (leave() / remote disconnect)
 *
 * Subscribe to changes via `call.subscribe(cb)` which fires on state or
 * participant changes (mirrors flags `onChange` / realtime `on` pattern).
 */
declare class Call {
    readonly id: string;
    private _state;
    private readonly _participants;
    private readonly _listeners;
    private readonly _room;
    private readonly _keyProvider;
    get state(): CallState;
    /** Snapshot of current remote participants (does NOT include the local participant). */
    get participants(): readonly CallParticipant[];
    /**
     * Subscribe to call changes (state + participant updates).
     * Returns an `Unsubscribe` function — matches the SDK's flags/auth pattern.
     */
    subscribe(callback: CallChangeCallback): Unsubscribe;
    /** Mute / unmute the local microphone. */
    mute(on: boolean): Promise<void>;
    /** Enable / disable the local camera. */
    setCamera(on: boolean): Promise<void>;
    /**
     * Set a raw frame encryption key (ArrayBuffer) for this call.
     * Design seam for SP-1.x web-MLS: call this with the MLS exporter secret
     * to enable frame-level E2EE via the media engine's external key provider.
     *
     * NOTE: The room must have been opened with `e2ee` options for this to take
     * effect. Currently calls connect WITHOUT e2ee — see module docstring.
     *
     * TODO(SP-1-web): wire this to MLS-derived key on session join.
     */
    setMediaKey(key: ArrayBuffer): Promise<void>;
    /** Leave the call and disconnect from the media room. */
    leave(): Promise<void>;
    private _setState;
    private _emit;
    private _upsertParticipant;
    private _attachTrack;
    private _wireMediaEvents;
}
declare class PalbeCalls {
    private readonly rt;
    constructor(rt: PalbeRuntime);
    /**
     * Start a new call in a messaging group.
     *
     * @param groupId  - Messaging group display-id (`grp_<uuidv7>`)
     * @param media    - Which media tracks to publish (default: audio + video)
     * @returns        A `Call` in `connecting` state; transitions to `active` once the media room connects.
     *
     * Every failure below arrives as kind `'server'` — this SDK's error kinds are
     * `notConfigured | validation | unauthorized | rateLimited | server | network
     * | decode`, and only a 401, a 429 or a 400 carrying a field-error array gets
     * its own kind. So branch on `err.code`, never on the kind.
     *
     * @throws BackendError('server', { code: 'calling_unavailable' })  no SFU configured on this stack (503)
     * @throws BackendError('server', { code: 'not_group_member' })     the caller is not a member of the group (403)
     * @throws BackendError('server', { code: 'call_room_full' })       the call is at its participant limit (409)
     * @throws BackendError('server', { code: 'call_provider_error' })  the media provider failed upstream (502)
     */
    start(groupId: string, { media }?: {
        media?: Array<'audio' | 'video'>;
    }): Promise<Call>;
    /**
     * Accept an incoming call in a messaging group.
     *
     * @param groupId  - Messaging group display-id
     * @param callId   - Call identifier, carried by the `call_invite` the server
     *   fans onto the group's conversation topic
     *   (`pb.realtime.channel('messaging:conv:<rfcGroupId>').on('call_invite', …)`).
     *   This SDK ships no web push: on the web the invite arrives over realtime or
     *   over whatever signalling the app already runs.
     * @param media    - Which media tracks to publish (default: audio + video)
     */
    accept(groupId: string, callId: string, { media }?: {
        media?: Array<'audio' | 'video'>;
    }): Promise<Call>;
    /**
     * Decline an incoming call.
     *
     * @param groupId  - Messaging group display-id
     * @param callId   - Call identifier
     * @param reason   - Optional decline reason string
     */
    decline(groupId: string, callId: string, reason?: string): Promise<void>;
    private _connect;
}

interface PalbeOAuthConfig extends OAuthConfig {
}
/** Baked into palbe.gen.ts by `palbase link` — the generated web config. */
interface PalbeConfig {
    url: string;
    apiKey: string;
    /** Registered app identity persisted by `palbase link`. */
    appId: string;
    oauth?: PalbeOAuthConfig;
    /**
     * Refresh-token persistence. Default: environment-scoped localStorage in
     * browsers, memory elsewhere.
     */
    storage?: SessionStorageAdapter;
    /** Extra headers on every request. */
    headers?: Record<string, string>;
    /** Auth encryption settings; defaults to the Palbase fleet trust root. */
    sealed?: HttpClientOptions$1['sealed'];
}

/** Frozen view of all cached flag values (what `all()` returns / `changes()` yields). */
type FlagsView = Readonly<Record<string, F>>;
/**
 * `pb.flags` — iOS-parity facade over `FlagsPool` (cache + delta polling +
 * auth binding) and `FlagsClient` (stateless transport).
 *
 * Start semantics: the facade is constructed lazily (first `pb.flags` touch).
 * - Browser: the pool starts right here in the constructor — cold snapshot +
 *   30s delta polling + visibility pause. "First use starts the machinery"
 *   without per-method start checks.
 * - Server (no `document`): NEVER auto-starts. `ready()`/`refresh()` are
 *   one-shot snapshot fetches with zero timers and zero storage access, so a
 *   pbServer request that reads flags pays exactly one HTTP call.
 *
 * localStorage persistence is scoped per environment ref (`palbe.flags.<ref>`),
 * mirroring the session-storage key convention.
 */
declare class PalbeFlags {
    private readonly transport;
    private readonly pool;
    constructor(rt: PalbeRuntime);
    /** Resolves once the first snapshot (or persisted hydrate) is available. Auto-starts the pool. */
    ready(): Promise<void>;
    /** Force an immediate re-snapshot. */
    refresh(): Promise<void>;
    /** Frozen snapshot of all cached values (identity-stable until a change). */
    all(): FlagsView;
    /** Raw cached value for `key`, or `undefined` when not in the cache. */
    get(key: string): F | undefined;
    /** `true` only when the cached value is strictly `true`; `fallback` when the key is absent. */
    isEnabled(key: string, fallback?: boolean): boolean;
    /** Alias of {@link isEnabled} (iOS parity). */
    bool(key: string, fallback?: boolean): boolean;
    /** Cached value when it is a string, else `fallback`. */
    getString(key: string, fallback: string): string;
    /** Cached value when it is an integer number, else `fallback`. */
    getInt(key: string, fallback: number): number;
    /** Cached value when it is a number (integers included), else `fallback`. */
    getDouble(key: string, fallback: number): number;
    /**
     * Resolve the multivariate variant for `key` — the variant name, or `null`
     * when the flag has no variant (or the read fails).
     *
     * Wire failures (network errors, 404, etc.) resolve to `null`.
     * Invalid flag names throw `BackendError('validation', { code: 'invalid_flag_name' })`.
     *
     * DEVIATION from iOS sync-cache parity: the platform does not propagate
     * variant metadata into the user-flags snapshot/delta cache, so this is an
     * ASYNC transport read (derived from `GET /v1/user-flags`), not a cache lookup.
     */
    getVariant(key: string): Promise<string | null>;
    /** Subscribe to any change in the cached flag set. */
    onChange(callback: () => void): Unsubscribe;
    /**
     * Observe ONE key: fires only when that key's value actually changes
     * (per {@link sameFlagValue} — structural compare for objects), with the
     * new value (`undefined` = deleted). P5 React-hook substrate.
     */
    subscribeKey(key: string, callback: (value: F | undefined) => void): Unsubscribe;
    /**
     * Async iteration over flag changes: yields the new {@link all} view on
     * every pool change notification. The listener is detached when the
     * consumer `break`s/`return`s/`throw`s — including while a `next()` is
     * still pending (it resolves `{ done: true }` instead of hanging, which a
     * plain async-generator `finally` would not guarantee).
     */
    changes(): AsyncIterableIterator<FlagsView>;
    /** Stop polling and detach all listeners (auth + visibility + subscribers). */
    destroy(): void;
}

/**
 * Pure deadline math — the web mirror of iOS DeadlineCalculator (Codex-finalized
 * restart conversion rule). Identical algorithm; web uses ms internally and
 * compares against ttlSeconds (converted). Clock readings are passed in so it is
 * fully table-testable and byte-identical with iOS.
 *
 * NOTE on the send-vs-arrival clamp: like iOS T3, this Calculator stays PURE — it
 * consumes an already-resolved anchor + the current clock readings. The
 * `min(sender_send_ts + ttl, first_arrival_monotonic + ttl)` effective-deadline
 * basis is applied at ARM time by the caller (Chat, T10), which picks the anchor's
 * monotonic baseline; the Calculator only converts that anchor into remaining/purge.
 */
interface AnchorTriple {
    mAnchorMs: number;
    wAnchorEpochMs: number;
    bAnchorToken: string;
}

/** A direct (1:1) chat or a multi-party group. */
type ChatKind = 'direct' | 'group';
/** A draft (local-only, not yet on the server) or an active (materialized) chat. */
type ChatState = 'draft' | 'active';
/** Server-side ACL role (group only; a direct chat has no roles). */
type ChatRole = 'owner' | 'admin' | 'member';
/** Whether a message was received (`incoming`) or sent by this device (`outgoing`). */
type MessageDirection = 'incoming' | 'outgoing';
/** A renderable message kind. `system` = a membership commit / control frame. */
type ChatMessageKind = 'text' | 'media' | 'system';
/**
 * A resolved mention span inside a message body. Produced at decode/merge time by
 * NORMALIZING the wire `body_ranges` (the pinned `normalizeMentionRangesUtf16`
 * contract) against the message text, then resolving the `mentionedUserId` to a
 * roster display name. Offsets are UTF-16 code units, half-open `[start, start+length)`.
 * `displayName` is `null` when the mentioned user is not in the local roster (the
 * renderer falls back to the underlying `text` slice). Mirrors iOS `ResolvedMention`.
 */
interface ResolvedMention {
    readonly start: number;
    readonly length: number;
    readonly mentionedUserId: string;
    readonly displayName: string | null;
}
/** A participating USER (not a device). For a direct chat: `[me, peer]`. */
interface ChatMember {
    /** == userId (stable identity). */
    readonly id: string;
    readonly userId: string;
    readonly displayName: string | null;
    readonly role: ChatRole;
    readonly isSelf: boolean;
}
/**
 * A resolved reply context — produced by `resolveReply` on the decode path.
 * `state:'resolved'` means the parent was found in local history and `quoteText`
 * is the REAL parent text (spoof-proof). `state:'unavailable'` means the parent
 * was not in local history; `quoteText` is the embedded preview body (may be null).
 */
interface ResolvedReply {
    readonly parentClientMsgId: string;
    readonly state: 'resolved' | 'unavailable';
    readonly quoteSenderUserId: string;
    readonly quoteText: string | null;
    readonly quoteKind: string;
}
/** One message in a chat transcript. */
interface ChatMessage {
    /** Routing-key-free id: `<chat.id>#<serverSeq>`. */
    readonly id: string;
    readonly kind: ChatMessageKind;
    readonly direction: MessageDirection;
    /** The sending USER id, when resolved (nil for system frames or unknown sender). */
    readonly senderUserId: string | null;
    readonly text: string | null;
    /** The server-minted per-group monotonic sequence (sort key + read cursor). */
    readonly serverSeq: number;
    /** When this device decoded (incoming) or sent (outgoing) the message. */
    readonly sentAt: Date;
    /** The client-minted idempotency id for this message (empty string for legacy/system). */
    readonly clientMsgId: string;
    /** Resolved reply context, or null if this is not a reply. */
    readonly replyTo: ResolvedReply | null;
    /**
     * Display-only reaction tally: `emoji → sorted reactor userIds[]`. Defaults to
     * `{}` (no reactions). Recomputed by the Chat from its authoritative
     * `ReactionFold` as reaction events fold onto this message. Reactions are never
     * a visible message of their own — they only mutate the target's tally.
     */
    readonly reactions: Record<string, string[]>;
    /**
     * Whether this message has been edited (edit-by-supersession). Defaults to
     * `false`. Once any valid author edit folds onto this message it stays `true`
     * forever (write-once, even if edited back to the original text). The rendered
     * `text` reflects the LATEST edit's text (`edit ?? original`). An edit is never
     * a visible message of its own — it only overlays the target's text + flag.
     */
    readonly edited: boolean;
    /**
     * Whether this message has been deleted-for-everyone (a cooperative encrypted
     * tombstone from the original sender). Defaults to `false`. Once a valid
     * tombstone folds onto this message it stays `true` (absorbing/sticky within
     * retention). A deleted message renders ONLY the neutral "deleted" descriptor
     * as its `text`, with reactions + reply + edit HIDDEN — delete DOMINATES edit.
     * A delete is never a visible message of its own. (delete-for-me is a separate,
     * local-only suppression that omits the message from this view entirely.)
     */
    readonly isDeleted: boolean;
    /**
     * The resolved mention spans on this message (defaults to `[]`). A mention is a
     * NORMAL bubble — these spans only annotate the existing `text` for highlighting,
     * they never make a message non-bubble. Recomputed by the Chat as the roster
     * resolves (display names are live, not snapshotted). When this message is
     * tombstoned (deleted-for-everyone) the spans are scrubbed to `[]` (delete
     * DOMINATES); when it is edited they reflect the EDIT's replacement `body_ranges`.
     */
    readonly mentions: ResolvedMention[];
    /**
     * The LOCAL purge deadline for this message (monotonic-derived, never a wire field).
     * `null` when this message has no TTL. The UI may show a countdown; the durable truth
     * is the persisted anchor + a re-check on every load (disappearing T10). A message's
     * effective TTL is its OWN per-message `expiry` if present, else the chat default
     * `timer_set` active AS OF this message's order (forward-only — a message ordered
     * BEFORE the governing `timer_set` inherits nothing; own-expiry WINS over the default).
     * Mirrors iOS `ChatMessage.effectiveExpiry` (which it derives from).
     */
    readonly expiresAt: Date | null;
    /**
     * Server-metadata cluster — the double-tick DELIVERED watermark on THIS user's OWN
     * (`direction === 'outgoing'`) messages, FOLDED TO USER-LEVEL. The wire carries the
     * acking device_id; the SDK folds across a peer's devices and across peers to ONE
     * user-level server_seq (MONOTONIC max — a stale lower incoming tick NEVER lowers it).
     * A per-message tick is "is `message.serverSeq <= deliveredUpTo`?". Absent (`undefined`)
     * until a `delivered` conv event covers this message; never set on an incoming message.
     * Mirrors iOS `Chat.deliveredUpTo` (a chat-level scalar there; per-message here).
     */
    readonly deliveredUpTo?: number;
    /**
     * Server-metadata cluster — the double-tick READ watermark on THIS user's OWN
     * (`direction === 'outgoing'`) messages, FOLDED TO USER-LEVEL + MONOTONIC max (same
     * fold as `deliveredUpTo`). Set by a `read` conv event. Read STAYS gated by the peer's
     * `share_receipts` server-side (the broadcast simply never arrives when muted); the
     * client fold is identical to delivered. Mirrors iOS `Chat.readUpTo`.
     */
    readonly readUpTo?: number;
}
/**
 * The per-(user, group) notify scope (the server-metadata MUTE toggle). `'all'`
 * (default, absent row) fires the push wake; `'none'` (muted) suppresses it. The raw
 * wire value is the snake-free `"all"`/`"none"` string. An unknown/garbage server value
 * maps to `'all'` at the surface — fail-OPEN, never silently mutes (mirrors iOS
 * `NotifyScope`). The server stores this opaque enum and stays MLS-blind (no content).
 */
type NotifyScope = 'all' | 'none';
/**
 * The caller's OWN unread view (the `GET /v1/messaging/groups/{gid}/unread` response).
 * Every field is an OPAQUE server-metadata integer (no message content): the group's max
 * server_seq, this caller's read + delivered cursors, and the server-derived unread
 * count. The camelCase mirror of the snake_case wire (`group_max_seq` → `groupMaxSeq`,
 * etc). Mirrors iOS `UnreadView`.
 */
interface UnreadView {
    /** The highest server_seq the group has reached (the newest message's seq). */
    readonly groupMaxSeq: number;
    /** The furthest server_seq THIS caller has marked read. */
    readonly lastReadSeq: number;
    /** The furthest server_seq THIS caller's devices have acked delivered. */
    readonly deliveredSeq: number;
    /** The server-derived unread count for this caller (clamped `>= 0` at the surface). */
    readonly unreadCount: number;
}
/** The receipt from a send — the server's monotonic sequence + accepted epoch. */
interface SentReceipt {
    readonly serverSeq: number;
    readonly epoch: number;
}
/** Per-user comms privacy prefs (defaults both-true). */
interface CommsPrefs {
    readonly sharePresence: boolean;
    readonly shareReceipts: boolean;
}
/** A presence snapshot for a user in a chat (60s TTL, device-union). */
interface PresenceState {
    readonly userId: string;
    readonly isOnline: boolean;
    readonly lastSeenAt: Date | null;
}
/** An unsubscribe handle (matches the flags/realtime/auth pattern). */
type Unsubscribe$1 = () => void;

/** A resolved group as the SDK tracks it. `name` is always null on web (no exporter). */
interface MessagingGroup {
    displayId: string;
    rfcGroupId: string;
    currentEpoch: number;
    ownerUserId: string | null;
    directKey: string | null;
    name: string | null;
}
interface QuotePreview {
    kind: string;
    author_user_id: string;
    body?: string;
    body_truncated: boolean;
}
interface ReplyRef {
    v: number;
    client_msg_id: string;
    preview?: QuotePreview;
}
/** A single mention range inside a message body.
 * Offsets are UTF-16 code units, half-open [start, start+length).
 * Wire: snake_case (mentioned_user_id, body_ranges) — web does RAW JSON, no case-convert.
 */
interface MentionRange {
    start: number;
    length: number;
    mentionedUserId: string;
}
/** Per-message TTL spec (decoded). senderSendTs present iff start === 'send'. */
interface ExpirySpec {
    v: number;
    ttlSeconds: number;
    start: 'send' | 'read';
    senderSendTs: number | null;
}

/** The intended participants of a draft chat (held until the first send). */
interface ChatDraft {
    mode: {
        kind: 'direct';
        peerUserId: string;
    } | {
        kind: 'group';
        members: string[];
    };
    /** The reserved local id a draft shows before it materializes. */
    reservedId: string;
}
/** The seam the Chat talks to for the work needing the resolved machinery. */
interface ChatBackend {
    selfUserId: string;
    /** Materialize a draft → the active group (DM get-or-create / group create+add). */
    materialize(draft: ChatDraft): Promise<MessagingGroup>;
    sendText(group: MessagingGroup, text: string, replyTo?: ReplyRef | null, bodyRanges?: MentionRange[] | null, expiry?: ExpirySpec | null): Promise<{
        receipt: SentReceipt;
        clientMsgId: string;
    }>;
    /** Send a reaction (add/remove an emoji on a target message) through the same
     * MLS application path as `sendText`. Returns the receipt + the wire clientMsgId. */
    sendReaction(group: MessagingGroup, args: {
        clientMsgId: string;
        targetClientMsgId: string;
        emoji: string;
        op: 'add' | 'remove';
    }): Promise<{
        receipt: SentReceipt;
        clientMsgId: string;
    }>;
    /** Send an edit (edit-by-supersession on a target message) through the same MLS
     * application path as `sendText`. Returns the receipt + the wire clientMsgId. */
    sendEdit(group: MessagingGroup, args: {
        clientMsgId: string;
        targetClientMsgId: string;
        newText: string;
        bodyRanges?: MentionRange[] | null;
    }): Promise<{
        receipt: SentReceipt;
        clientMsgId: string;
    }>;
    /** Send a delete-for-everyone tombstone on a target message through the same MLS
     * application path as `sendText` (the server stays blind — a delete is just
     * another opaque application message). Returns the receipt + the wire clientMsgId. */
    sendDelete(group: MessagingGroup, args: {
        clientMsgId: string;
        targetClientMsgId: string;
    }): Promise<{
        receipt: SentReceipt;
        clientMsgId: string;
    }>;
    history(group: MessagingGroup, limit: number, before?: number): Promise<ChatMessage[]>;
    members(group: MessagingGroup): Promise<ChatMember[]>;
    addMember(group: MessagingGroup, userId: string): Promise<void>;
    removeMember(group: MessagingGroup, userId: string): Promise<void>;
    leave(group: MessagingGroup): Promise<void>;
    registerActive(group: MessagingGroup): void;
    setTyping(group: MessagingGroup, isTyping: boolean): void;
    markRead(group: MessagingGroup, upToServerSeq: number): Promise<void>;
    /** Server-metadata cluster: set/get the per-(user,group) notify scope (mute) and
     * fetch the caller's own unread view. The server stays MLS-blind (opaque metadata). */
    setNotifyScope(group: MessagingGroup, scope: NotifyScope): Promise<NotifyScope>;
    getNotifyScope(group: MessagingGroup): Promise<NotifyScope>;
    unread(group: MessagingGroup): Promise<UnreadView>;
    /** Subscribe live message + conv (presence/typing/read/delivered) for an active group. */
    subscribeLive(group: MessagingGroup, chat: Chat): Unsubscribe$1;
    /** Resolve a sender device id → its owning user id (for senderUserId). */
    userIdForDevice(group: MessagingGroup, deviceId: string): Promise<string | null>;
    /** Load this chat's persisted delete-for-me suppression keys (durable, no wire). */
    loadSuppressed(group: MessagingGroup): Promise<string[]>;
    /** Persist this chat's delete-for-me suppression keys (durable, no wire). */
    saveSuppressed(group: MessagingGroup, keys: string[]): Promise<void>;
    /** Load this chat's persisted self-elevation dedup keys (durable, no wire) so a
     * re-delivered mention does not re-fire `onMentionElevation` after a cold launch. */
    loadElevated(group: MessagingGroup): Promise<string[]>;
    /** Persist this chat's self-elevation dedup keys (durable, no wire). */
    saveElevated(group: MessagingGroup, keys: string[]): Promise<void>;
    /** Send a per-chat default disappearing-timer control envelope (`timer_set`). Goes
     * through the SAME MLS application path as `sendText` — server-blind, never a bubble.
     * `ttlSeconds === null` disables the default. Returns the receipt + the wire clientMsgId. */
    sendTimerSet(group: MessagingGroup, args: {
        clientMsgId: string;
        ttlSeconds: number | null;
        start: 'send' | 'read';
    }): Promise<{
        receipt: SentReceipt;
        clientMsgId: string;
    }>;
    /** The persisted INTEGER `server_seq` tombstone set for a chat — drives transcript
     * exclusion (cold-launch) + redelivery drop (live arrival). Durable, no wire. */
    tombstonedSeqs(group: MessagingGroup): Promise<Set<number>>;
    /** The persisted STRING `client_msg_id` purge set — drives the orphan-fold resolver
     * (`authorOfTarget → 'purged'`) so a late edit DROPs / a late delete no-ops. */
    purgedClientMsgIds(group: MessagingGroup): Promise<Set<string>>;
    /** The persisted write-once anchor triple for a `clientMsgId`, or null if none. */
    anchor(group: MessagingGroup, clientMsgId: string): Promise<AnchorTriple | null>;
    /** Write-once: capture the first-arrival/first-read anchor triple for a `clientMsgId`
     * (a second call for the same id is a no-op, so the deadline never resets). */
    writeAnchorOnce(group: MessagingGroup, clientMsgId: string, a: AnchorTriple): Promise<void>;
    /** Tombstone-first purge commit point: persist the int `server_seq` + string
     * `client_msg_id` purge id in ONE durable record (idempotent). */
    tombstone(group: MessagingGroup, serverSeq: number, clientMsgId: string): Promise<void>;
}
declare class Chat {
    /** Stable, URL/log-safe id (the grp_ display id once active; a reserved local id while draft). */
    id: string;
    readonly kind: ChatKind;
    private _state;
    private _group;
    private _draft;
    private readonly backend;
    private messageList;
    private memberCache;
    private typingList;
    private presenceStates;
    private readWatermark;
    private titleOverride;
    private readonly seenKeys;
    /** Index: clientMsgId → { text, senderUserId } for resolveReply lookups. */
    private readonly byClientMsgId;
    /** The single authoritative reaction fold for this chat (live + own-send + history). */
    private readonly reactionFold;
    /** The single authoritative edit fold for this chat (live + own-send + history). */
    private readonly editFold;
    /** The single authoritative delete-for-everyone fold (live + own-send + history).
     * A tombstone scrubs its target in place (delete DOMINATES edit at render). */
    private readonly deleteFold;
    /** The per-chat default disappearing-timer fold — the latest valid `timer_set` (LWW
     * on (epoch, serverSeq), author = the resolved MLS sender). A `timer_set` is NEVER a
     * bubble; it routes here. The active default governs a subsequent bubble that carries
     * no per-message expiry (disappearing T10). */
    private readonly timerFold;
    /** Advisory in-memory purge timers, keyed by serverSeq. The DURABLE truth is the
     * persisted anchor + a re-check on every load; this just drives live eviction while
     * the tab is open. Cancelled when the message purges (disappearing T10). */
    private readonly purgeTimers;
    /** In-memory mirror of the durable `purgedClientMsgIds` set (the STRING namespace),
     * hydrated from `backend.purgedClientMsgIds` and grown by each live purge. Consulted
     * by `authorOfTarget` so a late edit/delete targeting a TTL-purged message resolves to
     * `'purged'` (DROP / no-op — never resurrects). Namespace-separate from the int seq
     * tombstone (disappearing T10). */
    private readonly purgedCids;
    private purgedLoaded;
    /** delete-for-me suppression keys (clientMsgId, or `seq:<serverSeq>` for legacy)
     * — the message is OMITTED from this view. Local + persisted per chat, NO wire. */
    private readonly suppressed;
    /** True once the persisted suppression set has been loaded (so the omit applies
     * even on the cold-launch hydrate path before a fresh deleteForMe). */
    private suppressedLoaded;
    /** Self-elevation dedup keys (`<selfUserId>|<clientMsgId or seq:n>`). Once a
     * mention of me from another sender fires `onMentionElevation`, its key lands here
     * + is persisted, so a re-delivery / cold-launch re-hydrate never re-fires. */
    private readonly elevated;
    /** True once the persisted elevation set has been loaded (so a re-delivered mention
     * on the cold-launch hydrate path dedups against the persisted decision). */
    private elevatedLoaded;
    /** Per-target BASE (original) text, so the rendered text is `edit ?? original`.
     * Seeded once per target (write-once base) so a 2nd own edit can't corrupt it. */
    private readonly originalTextByClientMsgId;
    /** Per-target AUTHOR userId — the EditFold author-gate input (filled at bubble
     * projection time from senderUserId; '' = resolved-but-unknown peer). */
    private readonly authorByClientMsgId;
    private loadedEarliestSeq;
    private historyLoaded;
    private wired;
    private liveUnsub;
    private readonly listeners;
    /**
     * Fires ONCE per `(selfUserId, clientMsgId)` when an INCOMING message mentions THIS
     * user from ANOTHER sender (not an edit). The dedup survives re-delivery + reload
     * via the persisted elevation set, so this never double-fires for one mention. The
     * app wires it to a buzz/badge (e.g. an in-app banner). Best-effort cooperative —
     * the SDK guarantees the DECISION, not the buzz. Mirrors iOS `Chat.onMentionElevation`.
     */
    onMentionElevation?: (message: ChatMessage) => void;
    /** Subscribe to any change in this chat (messages/members/typing/state). */
    onChange(cb: () => void): Unsubscribe$1;
    private emit;
    get state(): ChatState;
    get isDirect(): boolean;
    get messages(): readonly ChatMessage[];
    get members(): readonly ChatMember[];
    get typing(): readonly ChatMember[];
    get lastMessage(): ChatMessage | null;
    get unreadCount(): number;
    /**
     * The RENDER PRECEDENCE — the single composition point (live AND history project
     * through it identically). Over the raw `messageList` (which already carries the
     * folded edit text + reactions + reply):
     *   (1) in the delete-for-me suppression set → OMIT the message entirely;
     *   (2) else tombstoned (delete-for-everyone) → the neutral "deleted" descriptor
     *       with reactions/reply/edit HIDDEN (delete DOMINATES edit — short-circuit);
     *   (3) else the row as-is (edit overlay + reactions + reply already applied).
     * Pure over (messageList, deleteFold, suppressed) — recomputed on every read so a
     * just-folded delete / just-suppressed key takes effect without rewriting rows.
     */
    private surfaced;
    /** The delete-for-me suppression key: clientMsgId when present, else `seq:<n>`. */
    private suppressionKey;
    get title(): string;
    presence(userId: string): PresenceState | null;
    private ensureWired;
    /** Hydrate the durable `purgedClientMsgIds` set (once) into the in-memory mirror so the
     * live Edit/Delete fold author-gate sees TTL-purged targets as 'purged' on cold launch
     * (disappearing T10). No re-emit: it only gates the orphan-fold resolution. */
    private loadPurged;
    /** Hydrate the persisted delete-for-me suppression keys (once), then re-emit so
     * any already-surfaced suppressed message is omitted (cold-launch parity). */
    private loadSuppressed;
    /** Hydrate the persisted self-elevation dedup keys (once). No re-emit: the set only
     * gates the elevation DECISION, it does not change what renders. */
    private loadElevated;
    private hydrateHistory;
    private mergeHistory;
    /** Normalize a decoded `IncomingMessage.expiry` / `StoredMessage.expiry` into the
     * `ExpirySpec` the arm path consumes (or null when absent). */
    private toExpirySpec;
    /** The chat-default expiry derived from the active `timer_set` fold, as an `ExpirySpec`
     * so a bubble with no per-message expiry inherits it. null when no default is active or
     * the default was explicitly DISABLED (`ttlSeconds === null`). `senderSendTs` is null —
     * the default has no per-message sender clock; the arrival anchor drives the deadline
     * (mirrors iOS `defaultExpiry()`). */
    private defaultExpiry;
    /** The surfaced display deadline for an effective expiry (a local, monotonic-derived
     * value — the wall-clock projection of the TTL from now). null for a non-disappearing
     * message. The durable purge is driven by `armPurge`'s write-once anchor; this is the
     * UI countdown baseline. */
    private deadlineFor;
    /** Arm a message's TTL purge on first decrypt-and-display. Captures the WRITE-ONCE
     * monotonic/wall/boot anchor (so the deadline survives a reload — a re-arm after relaunch
     * reads back the ORIGINAL capture, never a fresh one → the deadline never resets),
     * computes the remaining time via `remainingSeconds`, applies the send-anchor clamp
     * `min(sender_send_ts+ttl, first_arrival+ttl)` (read-anchor uses the write-once first-read
     * capture), then either purges immediately or schedules an advisory `setTimeout`. A null
     * expiry / empty clientMsgId is a no-op. Mirrors iOS `armPurge`. */
    private armPurge;
    /** Re-arm a purge from a derived deadline (cold-launch hydrate path). The deadline is
     * the projection's monotonic-derived `expiresAt`; schedule an advisory timer for the
     * remaining time (purge immediately if the deadline has already passed). The durable
     * tombstone is written by `purge` when it fires (the crash-safe commit point). */
    private armFromDeadline;
    /** Purge message M (TTL eviction). TOMBSTONE-FIRST (the crash-safe commit point):
     * persist the `server_seq` tombstone + the `client_msg_id` purge id in ONE durable
     * record, THEN drop M's body from `messageList` + `emit()`, then re-evaluate any HELD
     * edit / PARKED delete targeting the now-purged cid so an orphan annotation DROPs/no-ops
     * (the resolver now returns `'purged'`). Idempotent. Mirrors iOS `purge`. */
    private purge;
    /** The Edit/Delete fold author-gate input via {@link AuthorResolution} (disappearing
     * T10 — the orphan-aware resolver): `'purged'` when the target's clientMsgId is in the
     * durable purge set (a late edit DROPs / a late delete no-ops — never resurrects a
     * disappeared message); `'author'` when its author is locally known → run the
     * author-gate; `'unknown'` otherwise → HOLD. The live twin of `projectHistory`'s
     * resolver. Captured as a bound arrow so it can be passed to the pure folds. */
    private readonly authorOfTarget;
    /** Resolve a message's decode-time mention spans: NORMALIZE the raw `body_ranges`
     * against `text` (the pinned `normalizeMentionRangesUtf16` cross-SDK contract) then
     * resolve each surviving range's `mentionedUserId` to a roster display name. An id
     * not in the roster resolves to `null` (the renderer falls back to the `text` slice).
     * Pure over (text, bodyRanges, memberCache); never throws. Mirrors iOS T3. */
    private resolveMentions;
    /** Re-resolve the roster display name on already-NORMALIZED spans (the history
     * projection produces them with null names — resolution is LIVE, not snapshotted).
     * A member rename then reflects on old messages. Returns the message unchanged when
     * it has no mentions (the common case) or no name changed. Mirrors iOS T3. */
    private resolveMentionNames;
    /** The WINNING edit's resolved mentions for a target (normalize its replacement
     * ranges against the new text + roster names), or `[]` if no winning edit / no
     * ranges. The edited message's mentions reflect the EDIT's ranges (mirrors iOS T3). */
    private editMentions;
    /** Resolve a userId → its roster display name (null if not a known member). */
    private displayNameOf;
    /** Compute the SELF-ELEVATION decision for a freshly-ingested INCOMING bubble and,
     * when it fires, record the dedup key (persisted) + invoke `onMentionElevation`.
     * Gate (mirrors iOS T3): a surviving mention targets THIS user AND the sender is not
     * me AND it's NOT an edit AND the `(selfUserId, clientMsgId|seq)` key isn't already
     * elevated. Dedup-once: the in-memory set gates the session, the persisted set
     * survives reload. An EDIT never reaches here (it folds, not a bubble) — the
     * `envelopeType !== 'edit'` guard is belt-and-braces. */
    private elevateIfMentioned;
    /** Seed the per-target base text + author for the edit fold. Base is write-once
     * (a later own/peer edit must not overwrite the original we render against). The
     * author is (re)recorded whenever a non-empty resolution is available. */
    private seedEditBase;
    /**
     * Rebuild the target message's `reactions` from the authoritative fold and
     * re-emit. No-op when the target isn't present yet (its tally is attached the
     * moment it lands, via the append/merge paths) or when the tally is unchanged.
     */
    private recomputeReactions;
    /**
     * Overlay the authoritative fold's tally onto a message as it is appended/merged.
     * The Chat fold WINS when it has a non-empty tally; otherwise the tally already
     * attached upstream (the coordinator's page-local history fold) is preserved.
     */
    private applyReactionTally;
    /**
     * Rebuild the target message's rendered `text` + `edited` flag from the
     * authoritative edit fold and re-emit, PRESERVING `.reactions` and `.replyTo`
     * (the reaction-polish lesson — never clobber). text = `editFold.text(cid) ??
     * base`; base is the seeded original so a forged/ignored edit leaves it intact.
     * No-op when the target isn't present yet (the fold already recorded it; the
     * overlay applies the moment the target lands) or when unchanged.
     */
    private recomputeEdit;
    /**
     * Overlay the authoritative edit fold's winning text + flag onto a message as it
     * is appended/merged. The fold WINS when it has an edit for this target;
     * otherwise the upstream `text`/`edited` (e.g. the coordinator's page-local
     * history fold) is preserved. PRESERVES reactions + replyTo.
     */
    private applyEditOverlay;
    private kindOf;
    private internalKey;
    private publicId;
    /** Page older messages in. Returns how many were prepended. */
    loadEarlier(limit?: number): Promise<number>;
    private refreshMembers;
    /** Re-resolve roster display names across the whole transcript (called on a roster
     * change). Re-emits only if any name actually changed. */
    private reresolveAllMentionNames;
    private seedMembersFromGroup;
    private seedDraftMembers;
    send(text: string, opts?: {
        replyTo?: ChatMessage;
        mentions?: MentionRange[];
        expiresIn?: {
            ttlSeconds: number;
            start?: 'send' | 'read';
        };
    }): Promise<SentReceipt>;
    /** Resolve a send's effective per-message expiry at COMPOSE TIME: the caller's explicit
     * `expiresIn` if present, ELSE the chat's active default timer stamped onto the message
     * NOW (the durable record per spec §"Compose-time stamping"). A `send`-anchored expiry
     * (explicit or default-inherited) stamps `senderSendTs` = the sender's compose epoch
     * seconds; a `read`-anchored one carries none (the deadline is the recipient's local
     * first-read). Returns null when there is neither an explicit expiry nor an active
     * default (a plain, non-disappearing send). Mirrors the iOS compose-time stamping. */
    private composeExpiry;
    /** Set (or DISABLE) this chat's DEFAULT disappearing timer. Emits a `timer_set` control
     * envelope (server-blind — an opaque application message, NEVER a bubble) and folds the
     * own-set locally so the default applies immediately to subsequent sends that carry no
     * per-message expiry. `ttlSeconds === null` DISABLES the default. FIRE-AND-FORGET
     * ADVISORY: returns on the LOCAL emit only; it exposes NO "active for all peers" signal.
     * Mirrors iOS `setDisappearing(ttlSeconds:start:)`. */
    setDisappearing(opts: {
        ttlSeconds: number | null;
        start?: 'send' | 'read';
    }): Promise<void>;
    private appendOwnSend;
    private materializeIfNeeded;
    addMemberUser(userId: string): Promise<void>;
    removeMemberUser(userId: string): Promise<void>;
    leave(): Promise<void>;
    setTyping(isTyping: boolean): void;
    markRead(message: ChatMessage): Promise<void>;
    /** Set this chat's notify scope (the mute toggle). `'none'` mutes the push wake;
     * `'all'` unmutes (the default). Materializes a draft first (the scope is a
     * per-(user,group) server row), PUTs `/notify`, and returns the server-echoed scope.
     * Mirrors iOS `Chat.setNotifyScope`. */
    setNotifyScope(scope: NotifyScope): Promise<NotifyScope>;
    /** Refresh + return this chat's notify scope from the server (fail-OPEN to `'all'`).
     * Returns `'all'` for a draft chat (no server row yet). */
    getNotifyScope(): Promise<NotifyScope>;
    /** Fetch the caller's authoritative SERVER unread count (opaque server metadata).
     * Returns the clamped count (`max(0, …)`); `0` for a draft chat. The local computed
     * `unreadCount` getter stays the instant, offline best-effort badge — this is the
     * canonical count on demand. Named distinctly so it does not shadow the observable
     * `unreadCount` snapshot getter. Mirrors iOS `Chat.refreshUnread`. */
    unreadCountFromServer(): Promise<number>;
    /** Add an emoji reaction to a message. No-op if the message isn't reactable
     * (empty clientMsgId — a legacy/system row). The reaction folds locally with
     * the server receipt's `(epoch, serverSeq)` so the target's tally updates
     * instantly; the durable echo on the next pump is a fold no-op (dedup on the
     * SAME wire clientMsgId). Never appends a bubble. */
    react(message: ChatMessage, emoji: string): Promise<void>;
    /** Remove this user's emoji reaction from a message (op:'remove'). */
    unreact(message: ChatMessage, emoji: string): Promise<void>;
    private sendReaction;
    /** Edit an own text message (edit-by-supersession). No-op if the message isn't
     * editable (empty clientMsgId, or not a `text` kind). The edit folds locally
     * with the server receipt's `(epoch, serverSeq)` so the target's text updates
     * instantly; the durable echo on the next pump is a fold no-op (dedup on the
     * SAME wire clientMsgId). Never appends a bubble; PRESERVES the target's
     * reactions + reply context. Only the original author's edits count — for an own
     * message self IS the author, so the author-gate passes. `opts.mentions` carries the
     * edit's REPLACEMENT mention ranges → the edited message's mentions reflect them. */
    edit(message: ChatMessage, newText: string, opts?: {
        mentions?: MentionRange[];
    }): Promise<void>;
    /** Delete a message for EVERYONE (a cooperative encrypted tombstone). Only the
     * ORIGINAL SENDER can do this — for an own message self IS the author, so the
     * author-gate passes. Legacy messages (empty clientMsgId) are DISABLED (a
     * tombstone keys on the target's clientMsgId, which they lack) — no-op. Sends a
     * `type:'delete'` envelope through the SAME MLS path as a text message (the
     * server stays blind), folds the own delete locally so the target scrubs in
     * place instantly (the durable echo dedups on the SAME wire clientMsgId), and
     * re-emits. NEVER appends a bubble. delete-for-me'ing the target becomes moot. */
    deleteForEveryone(message: ChatMessage): Promise<void>;
    /** Delete a message for ME only — a LOCAL, per-device suppression. NO wire, NO
     * attribution, no server contact: the message is OMITTED from THIS view and the
     * suppression key persists per chat (survives reload). The key is the message's
     * clientMsgId when present, else `seq:<serverSeq>` for legacy messages. */
    deleteForMe(message: ChatMessage): Promise<void>;
}

declare class PalbeMessaging {
    private readonly coordinator;
    constructor(rt: PalbeRuntime);
    /**
     * Warm messaging at sign-in (optional). Enrolls this device + starts the live
     * delivery source so incoming DMs/Welcomes drain before the chat list opens.
     * Never REQUIRED — any chat op self-enrolls. Idempotent.
     */
    start(): Promise<void>;
    /**
     * Open the ONE direct chat with `userId`. INSTANT + LOCAL — no network, nothing
     * created yet. Returns a draft `Chat` to show immediately; the server group +
     * MLS material materialize LAZILY on the first `chat.send`. Idempotent + stable:
     * the same two users always resolve to the SAME Chat.
     */
    directChat(userId: string): Chat;
    /**
     * Open a multi-party group chat. LOCAL + LAZY like `directChat`: pick the
     * members, get a draft Chat, the group is created on the FIRST `chat.send`.
     */
    groupChat(opts?: {
        members?: string[];
    }): Chat;
    /** Look up a chat by id (e.g. from a push payload / deep link). null if unknown. */
    chat(id: string): Chat | null;
    /** The observable chat list (DMs + groups, active only). Read it after an
     * `onChatsChange` subscription to render the inbox. */
    get chats(): readonly Chat[];
    /** Subscribe to chat-list changes (a chat added/removed/hydrated). */
    onChatsChange(cb: () => void): Unsubscribe$1;
}

/** The Faz-1 trace kinds plus the Faz-1.5 web-vital family. */
type PerfTraceType = 'network' | 'app_start' | 'custom' | 'web_vital';
/**
 * One perf measurement, shaped EXACTLY as the ingest wire expects. Keys are
 * snake_case to match the Go decode tags — do not rename to camelCase.
 */
interface PerfItem {
    /** Client-generated UUIDv7 — server dedup key. */
    row_id: string;
    trace_type: PerfTraceType;
    name: string;
    /** Duration in milliseconds. */
    value: number;
    counters?: Record<string, number>;
    attrs?: Record<string, string>;
    request_id?: string;
    /** Unix milliseconds. */
    timestamp: number;
}

/**
 * Bounded FIFO perf-item queue. `enqueue` appends and evicts the oldest on
 * overflow; `drainAll` returns everything (oldest-first) and clears the store;
 * `count` is the current depth; `dropped` is the cumulative eviction counter.
 *
 * When `localStorage` is present the queue is read-through / write-through to a
 * fixed key, so a fresh instance after a reload sees the persisted items. With
 * no `localStorage` it is purely in-memory.
 */
declare class PerfOfflineQueue {
    private items;
    private _dropped;
    private readonly maxItems;
    constructor(maxItems?: number);
    /** Append items; FIFO-evict the oldest when over `maxItems`. */
    enqueue(items: PerfItem[]): void;
    /** Return all queued items (oldest-first) and clear the queue + store. */
    drainAll(): PerfItem[];
    /** Current queue depth. */
    get count(): number;
    /** Cumulative count of FIFO-evicted items (a `dropped` metric, not silent). */
    get dropped(): number;
    /** Drop the oldest items until at most `maxItems` remain, counting each. */
    private trim;
    private persist;
    private clearStore;
}

/**
 * The mutable PalPerf state shared between the facade and the network hook.
 * `testDevice` is signalled to the server via the `X-Palbase-Test-Device: 1`
 * request header (server-authoritative tagging — the SDK only flips the bit).
 */
declare class PerfState {
    /** Pending, un-flushed perf items (FIFO). */
    readonly buffer: PerfItem[];
    /** When true, every flush carries `X-Palbase-Test-Device: 1`. */
    testDevice: boolean;
    enqueue(item: PerfItem): void;
    /** Detach up to `MAX_PERF_BATCH` items for one POST (FIFO order preserved). */
    take(limit?: number): PerfItem[];
    get size(): number;
}

/**
 * A running custom trace. `putAttribute`/`incrementMetric` accumulate metadata;
 * `stop()` records ONE `custom` PerfItem whose `value` is the elapsed
 * milliseconds since `startTrace`. Idempotent: a second `stop()` is a no-op.
 */
declare class PerfTrace {
    private readonly name;
    private readonly onStop;
    private readonly attrs;
    private readonly counters;
    private readonly startedAt;
    private stopped;
    constructor(name: string, onStop: (item: PerfItem) => void);
    putAttribute(key: string, value: string): void;
    incrementMetric(name: string, by?: number): void;
    stop(): void;
}
declare class PalbePerf {
    private readonly rt;
    private readonly state;
    /** Durable offline buffer for failed flushes (persist-on-fail). Browser →
     * localStorage-backed; server → in-memory. */
    private readonly queue;
    private flushTimer;
    /** Browser → buffer + size/timer flush. Server (no document) → immediate
     * per-item flush, zero timers (nothing leaks into RSC/route handlers). */
    private readonly browser;
    /** Bound `online` handler so it can be removed on `dispose()` (no leak). */
    private readonly onOnline;
    /** Server-controlled client-side sample rate (0..100). 100 until the config
     * client fetches `/v1/analytics/perf/config` — the SDK obeys this ceiling and
     * never raises its own rate (invariant 3). `record` drops an item whose
     * deterministic `row_id` bucket is >= this pct, mirroring the server's
     * `SampleDecision` so client + server keep the SAME rows. */
    private samplePct;
    constructor(rt: PalbeRuntime, state?: PerfState, 
    /** Durable offline buffer for failed flushes (persist-on-fail). Browser →
     * localStorage-backed; server → in-memory. */
    queue?: PerfOfflineQueue);
    /** Remove the `online` listener. Called when the runtime is replaced so the
     * handler does not outlive this facade. No-op outside the browser. */
    dispose(): void;
    /** Mark (or unmark) this client's traffic as test — the server tags the rows
     * when the `X-Palbase-Test-Device: 1` header rides along on flush. */
    setTestDevice(on: boolean): void;
    /** Apply the server-resolved client-side sample rate (0..100), clamped. Called
     * by `PerfConfigClient` after fetching `/v1/analytics/perf/config`. The SDK
     * OBEYS this value — it is a ceiling, never raised locally. */
    setSamplePct(pct: number): void;
    /** Pending (un-flushed) buffer depth. Test-only visibility into the buffer so
     * the remote-sampling tests can assert how many items were sampled in. */
    get bufferSizeForTest(): number;
    /** Opt-in: wrap the global `fetch` so every app-level request is recorded as a
     * redacted `network` perf item (the `/v1/analytics/*` ingest paths are
     * self-excluded). OFF by default — swizzling a global is a page-wide side
     * effect. Returns an `uninstall` that restores the original `fetch`. */
    enableFetchCapture(): () => void;
    /** Start a custom trace; the returned handle records a `custom` item on
     * `.stop()`. */
    startTrace(name: string): PerfTrace;
    /** Buffer one perf item. In the browser, flush on size/timer; on the server
     * flush immediately (no timers). Never throws.
     *
     * Client-side remote sampling: an item whose deterministic `row_id` bucket is
     * NOT below the server-controlled `samplePct` is dropped before buffering —
     * the SAME FNV-1a-mod-100 decision the server applies at ingest, so the two
     * keep identical rows and the SDK saves the upload (defense-in-depth: the
     * server re-samples authoritatively). */
    record(item: PerfItem): void;
    /** Buffer a network trace — called by `request.ts` around `rt.http.request`
     * (the analytics ingest path is excluded by the caller to avoid recursion). */
    recordNetwork(method: string, url: string, status: number, durationMs: number, requestId?: string): void;
    /** Drain the offline queue (oldest-first) and the live buffer to
     * `/v1/analytics/perf` (≤100 items per request, sequential). Resolves when
     * delivery finished; NEVER rejects. A failed slice is NOT dropped — it goes
     * to the offline queue (persist-on-fail) so the next flush (size/timer or the
     * `online` reconnect event) retries it. Items keep their original `row_id`,
     * so a redelivery dedups server-side (ReplacingMergeTree). */
    flush(): Promise<void>;
    private startTimer;
    private cancelTimer;
}

/**
 * The connection state of the shared realtime WebSocket (iOS enum parity), plus
 * `'error'` — surfaced when a channel could not be recovered after a
 * token-expiry close exhausted its rejoin attempts (the socket itself may still
 * be up; the app should stop expecting events on the dead channel).
 */
type RealtimeConnectionState = 'idle' | 'connected' | 'reconnecting' | 'error';

/** An inbound broadcast payload (the inner `payload` of the Phoenix envelope). */
type RealtimePayload = Record<string, unknown>;
type RealtimeHandler = (payload: RealtimePayload) => void;
/** A cancellable realtime subscription. `cancel()` removes the handler and,
 * when it was the channel's last, leaves the channel on the shared socket.
 * Cancelling twice is a no-op. */
interface RealtimeSubscription {
    cancel(): void;
}
interface RealtimeStatusSnapshot {
    state: RealtimeConnectionState;
    lastEventAt: Date | null;
}
/**
 * The observable connection status (`pb.realtime.status`) — the plain-JS
 * analogue of the iOS `@Observable RealtimeStatusStore`. `state` drives a
 * live "connected" badge; `lastEventAt` proves a push actually arrived.
 * `onChange` fires on state transitions and on every recorded event.
 */
interface RealtimeStatus {
    readonly state: RealtimeConnectionState;
    readonly lastEventAt: Date | null;
    onChange(callback: (status: RealtimeStatusSnapshot) => void): Unsubscribe;
}
/** Why the server refused a channel. */
interface RealtimeChannelError {
    /** The channel this is about. */
    topic: string;
    /** Exactly what the server said: `"unauthorized"` or `"unavailable"`. */
    reason: string;
    /**
     * Whether asking again could succeed. `unavailable` (the project could not be
     * reached to decide) is retryable and the socket retries it on reconnect;
     * `unauthorized` is a settled answer and is not.
     */
    retryable: boolean;
}
/**
 * A subscription handle for one realtime channel (returned by
 * `pb.realtime.channel(name)` — the SAME instance per name). A channel is
 * joined on the shared socket when its first handler is added (or on the
 * first `send`) and left when its last handler cancels.
 */
declare class RealtimeChannel {
    /** The app-defined channel name (bare sub-topic, no "realtime:" prefix). */
    readonly name: string;
    private readonly owner;
    /**
     * Subscribe `handler` to `event` on this channel. Fire-and-forget: the
     * join rides the shared socket asynchronously. Hold the returned
     * subscription and `cancel()` it to stop.
     */
    on(event: string, handler: RealtimeHandler): RealtimeSubscription;
    /**
     * Called when the server REFUSES this channel.
     *
     * A join is an authorization decision, and a decision the app never hears is
     * the same as no decision at all: silence looks exactly like a slow network.
     * This is where a refusal arrives, carrying the server's own distinction —
     * `retryable: false` means "you may not" and asking again will not help;
     * `retryable: true` means the project could not be asked, and the socket's
     * next reconnect retries on its own.
     *
     *     pb.realtime.channel('room:42').onError((err) => {
     *       if (!err.retryable) showJoinDenied()
     *     })
     */
    onError(handler: (error: RealtimeChannelError) => void): RealtimeSubscription;
    /**
     * Broadcast `payload` to the channel's other subscribers (web addition —
     * iOS is receive-only). Joins the channel if it isn't already; queued
     * until the join is live on the socket.
     */
    send(event: string, payload?: RealtimePayload): void;
    /**
     * Watch one key of the channel's shared state.
     *
     * The handler is called with the CURRENT value straight away when there is
     * one, and again on every change. That is the difference from `on()`: a
     * subscriber to an event learns nothing until the next one, while state is
     * already there when you ask.
     */
    onState(key: string, handler: (value: unknown) => void): RealtimeSubscription;
    /** Read one key without subscribing. */
    stateValue(key: string): unknown;
    /** Write one key. `durable` outlives this connection; `ephemeral` is reaped
     * when it closes, which is what presence is built on. */
    setState(key: string, value: unknown, opts?: {
        life?: 'ephemeral' | 'durable';
    }): void;
    /** Remove a key this connection wrote. */
    clearState(key: string): void;
    /**
     * Announce this client on the channel. `meta` is whatever other participants
     * should see — a name, an avatar, a cursor.
     *
     * It is ephemeral state keyed by this connection, so it disappears when the
     * socket does. Nothing has to be un-announced on a crash.
     */
    presenceEnter(meta: RealtimePayload): void;
    /** Replace the announced value — a cursor moving is this, at whatever rate
     * the app likes: the server conflates writes it cannot deliver fast enough. */
    presenceUpdate(meta: RealtimePayload): void;
    /** Leave early. Closing the socket does this on its own. */
    presenceLeave(): void;
    /** Everyone else currently announced, this client excluded. */
    presenceOthers(): unknown[];
    /** Watch the announced set. Called on every change. */
    onPresence(handler: (others: unknown[]) => void): RealtimeSubscription;
}
declare class PalbeRealtime {
    private readonly rt;
    private socket;
    private readonly channels;
    private readonly statusStore;
    private readonly handlers;
    private readonly errorHandlers;
    private readonly topicRefcount;
    private readonly states;
    private readonly connIds;
    private readonly pendingPresence;
    private readonly stateWatchers;
    private readonly presenceWatchers;
    constructor(rt: PalbeRuntime);
    /**
     * Get the handle for an app-defined channel (e.g. "room:42"). The same
     * name returns the SAME instance. Throws a guided error on server-side
     * hosts (SSR/RSC/Node) — realtime is client-only.
     */
    channel(name: string): RealtimeChannel;
    /**
     * Tear down the shared socket and clear all channel state. Called by
     * `__configure` and `__reset` when the runtime is replaced, so old sockets
     * are not left open and heartbeat timers do not leak.
     */
    destroy(): void;
    /** The observable connection status. Safe to read anywhere (reports `idle` until a socket exists). */
    get status(): RealtimeStatus;
    /**
     * Hand the socket a fresher credential for the SAME user, without rejoining.
     *
     * Called when the app's token rotates. The alternative — letting the channels
     * die at expiry and rejoining — reaps this connection's ephemeral entries
     * (its presence, on every channel) and forces a full state resync. A token
     * getting older is not a disconnection and must not cost one.
     *
     * A no-op before a socket exists: the first connect resolves a fresh token
     * on its own.
     */
    refreshToken(token: string): void;
    /** Lazily build + start the shared socket on first subscription/send. */
    private ensureSocket;
    private route;
    /**
    /**
     * The server refused a channel. Tell whoever asked, and — when the answer is
     * final — stop pretending the app is subscribed to it.
     *
     * `unavailable` leaves everything in place: the project could not be reached
     * to decide, the socket rejoins on its next reconnect, and dropping the app's
     * handlers would make a momentary outage look like a permanent denial.
     */
    private handleChannelRefused;
    /**
     * A channel died for good — a token-expiry rejoin that exhausted its attempts.
     * The app must stop expecting anything on it, and the status observable flips
     * to `'error'` (the React `useChannel` hook reports that).
     *
     * It clears the SAME registries a final refusal clears, and used to clear only
     * the event handlers. A state or presence watcher left behind here waits
     * forever for a snapshot that cannot arrive, and fires twice if the app ever
     * re-subscribes — the identical failure its sibling three functions up
     * describes, on a channel that was given up on rather than refused.
     */
    private handleChannelError;
    /** Drop every registration this topic holds. One place, because "which
     *  registries" is a question two callers must never answer differently. */
    private forgetTopic;
    private retainTopic;
    private releaseTopic;
    private applySnapshot;
    private applyDiff;
    private applyJoinInfo;
    private notifyState;
}

interface PalbeRuntime {
    config: PalbeConfig;
    /**
     * The project this runtime talks to, read from the publishable key.
     *
     * Exposed here so every consumer takes it from ONE derivation. It used to be
     * a field on the config that had to equal the key's — see buildRuntime.
     */
    projectRef: string;
    http: HttpClient$1;
    tokenManager: TokenManager$1;
    authClient: AuthClient;
    auth: PalbeAuth;
    flags: PalbeFlags;
    realtime: PalbeRealtime;
    analytics: PalbeAnalytics;
    calls: PalbeCalls;
    messaging: PalbeMessaging;
    /**
     * PalPerf surface. EAGER (like analytics identity): `request.ts` records a
     * `network` trace around EVERY SDK fetch, so the facade must exist from the
     * first request — never lazy. The buffer/timer it owns is inert until the
     * first item is recorded.
     */
    perf: PalbePerf;
    storage: SessionStorageAdapter;
    /**
     * Destroy the realtime facade if it was already constructed (no-op otherwise).
     * Called by `__configure` / `__reset` when the runtime is replaced so the old
     * socket is closed and heartbeat timers do not leak.
     */
    destroyRealtime(): void;
}
declare function buildRuntime(config: PalbeConfig, options?: {
    oauthStorage?: OAuthTransactionStorage;
}): PalbeRuntime;

type MagicLinkResult = ({
    status: 'signedIn';
} & AuthSuccess) | {
    status: 'mfaRequired';
    mfaToken: string;
    factors: string[];
};
type OAuthExchangeResult = ({
    status: 'signedIn';
    isNewUser: boolean;
} & AuthSuccess) | {
    status: 'mfaRequired';
    mfaToken: string;
    factors: string[];
} | {
    status: 'linked';
    identity: Identity;
    userId: string;
};
interface AuthUser {
    id: string;
    /** null for phone-only users (the server omits email). */
    email: string | null;
    emailVerified: boolean;
    createdAt: string;
    /**
     * The caller's APPLICATION roles, as assigned in `auth.user_roles`.
     *
     * Compare against the generated `Roles` constants rather than string
     * literals — a role withdrawn upstream disappears from that module, so code
     * still naming it stops building instead of quietly losing access:
     *
     * ```ts
     * import { Roles } from './palbe.gen';
     * if (pb.auth.currentUser?.roles.includes(Roles.moderator)) …
     * ```
     *
     * Empty array for a caller who holds none, never null: `.includes(…)` needs
     * no guard. This is the UI's hint, not the boundary — the server decides,
     * and it decides again on every request.
     */
    roles: string[];
}
/** What `pb.auth.getSignInMethods()` reports about an account's credentials. */
interface SignInMethods {
    /** A local password exists — offer "change password", not "set password". */
    password: boolean;
    /** An MFA factor is enrolled. */
    mfa: boolean;
    /**
     * Linked OAuth providers, e.g. `['google']`. `[]` means none are linked;
     * `null` means the server could not determine it (social login is not
     * configured, or the lookup failed) — treat null as unknown, not as none.
     */
    providers: string[] | null;
}
interface AuthSuccess {
    user: AuthUser;
    session: Session$1;
}
type AuthState = {
    status: 'signedIn';
    user: AuthUser;
} | {
    status: 'signedOut';
};
type AuthChangeEvent = {
    type: 'signedIn';
    user: AuthUser;
} | {
    type: 'signedOut';
    /**
     * `userInitiated` — pb.auth.signOut(); `sessionExpired` — a refresh
     * ultimately failed; `accountDeleted` — this device ran deleteAccount();
     * `sessionInvalid` — a server-side session kill (erased/revoked subject)
     * was observed on a request and the client tore down reactively.
     */
    reason: 'userInitiated' | 'sessionExpired' | 'accountDeleted' | 'sessionInvalid';
} | {
    type: 'tokenRefreshed';
};
type Unsubscribe = () => void;
declare class PalbeAuth {
    private readonly rt;
    private cachedUser;
    private signingOut;
    private nextSignOutReason;
    private signingIn;
    private readonly oauthCompletions;
    private signedInState;
    private hydratingUser;
    private readonly stateListeners;
    private readonly eventListeners;
    private readonly userListeners;
    constructor(rt: PalbeRuntime);
    get currentUser(): AuthUser | null;
    get isSignedIn(): boolean;
    /**
     * Create an account.
     *
     * `locale` is an explicit choice of the language the account's mail is
     * written in, and the stack STORES it. Left out, the request carries the
     * PAGE's language (`<html lang>`) as its Accept-Language — the language the
     * person is reading the sign-up form in — and nothing is stored: the stack
     * reads it for this mail only (palgroup/palbase#24).
     *
     * Why not store the page language: a template's hard-coded `lang="en"` is
     * common, and a stored "en" would outrank every later request's language for
     * good. Why not leave the browser's own header: it is the browser's interface
     * language, and a Turkish page in an English browser would get English mail.
     */
    signUp(params: {
        email: string;
        password: string;
        locale?: string;
    }): Promise<AuthSuccess>;
    signIn(params: {
        email: string;
        password: string;
    }): Promise<AuthSuccess>;
    signOut(): Promise<void>;
    /**
     * Self-service account erasure ("right to be forgotten"). Calls palauth
     * `DELETE /auth/user` (session-authed + fresh re-auth): password users pass
     * `{ password }`; passwordless/OAuth users rely on a freshly stepped-up
     * session. The handler answers **204 with no body** — the erasure has already
     * finished and every session is already revoked server-side — so we tear down
     * local state (mirroring `signOut()`'s clear, minus the pointless `/logout`)
     * and emit `signedOut{reason:'accountDeleted'}`.
     *
     * Returns nothing, because there is nothing to return: the handler used to
     * answer 202 with an `{erasure_id}` naming an asynchronous run, and that id
     * was removed along with the run (`gdpr_handlers.go:221-229`). Reading it
     * here threw a `TypeError` AFTER the account was already gone — a success
     * reported as a failure.
     *
     * On 401 `reauth_required` / 503 `not_configured` (or `erasure_unavailable`)
     * the request throws BEFORE the teardown line, so the local session is left
     * fully intact — the deletion did not happen and the user is still signed in.
     */
    deleteAccount(params?: {
        password?: string;
    }): Promise<void>;
    getUser(): Promise<AuthUser>;
    /**
     * Which credentials this account actually has.
     *
     * An account reached through Google has no password, so showing it a
     * "current password" field gives the user something they can never fill —
     * and `getUser()` cannot tell you, because GET /auth/user carries no
     * credential information. Read this before rendering any re-auth or
     * change-password form.
     */
    getSignInMethods(): Promise<SignInMethods>;
    refreshUser(): Promise<AuthUser>;
    /**
     * Restore the user after a session was rehydrated from storage (page reload).
     * Hydration in buildRuntime restores the TOKENS synchronously, but the access
     * token JWT does not carry emailVerified/createdAt, so the full AuthUser can't
     * be reconstructed offline — this fetches GET /auth/user once and announces
     * `signedIn`, so the app no longer has to `await pb.auth.refreshUser()` itself
     * on boot. Idempotent (runs once), browser-safe (no-op when not signed in or
     * a user is already cached), and never throws (a boot-time network failure
     * must not break app startup — isSignedIn stays true, the app can retry).
     */
    hydrateUser(): void;
    private permissionsStore;
    /** The caller's live permission set — see PalbePermissions. Lazy: a server
     * request that never asks pays nothing (no realtime socket). The FIRST access
     * binds synchronously and lets a realtime refusal (no browser environment)
     * THROW here, with the guided message — an empty set answered in silence
     * would read as "no permissions". */
    get permissions(): PalbePermissions;
    /** FR-010: fires with the permission a 403 named in `required`. Refetch the
     * object the screen was drawn from; the error itself is thrown as always.
     * Handlers live in a module-level relay (like iOS' PermissionDeniedRelay), so
     * a re-`__configure` — which replaces the HttpClient — does not lose them. */
    onPermissionDenied(handler: (required: string) => void): Unsubscribe;
    /**
     * Subscribe to signed-in/signed-out state. Fires immediately with the
     * current snapshot (iOS parity). A restored session (page reload) hydrates
     * the user asynchronously via `hydrateUser()` (fired once at boot), so the
     * FIRST snapshot may report signedOut for a tick even when `isSignedIn` is
     * true; the listener then fires again with `signedIn` once the user lands.
     * Rely on `isSignedIn` for the session truth if you need it synchronously.
     */
    onAuthStateChange(callback: (state: AuthState) => void): Unsubscribe;
    onAuthEvent(callback: (event: AuthChangeEvent) => void): Unsubscribe;
    /** Subscribe to user-profile changes. Replays the cached user on subscribe (iOS parity). */
    onUserChange(callback: (user: AuthUser) => void): Unsubscribe;
    private snapshotState;
    /**
     * Listener exception isolation: a throwing consumer callback must never
     * break delivery to other listeners nor propagate into the emit caller
     * (tokenManager.clearSession callers, pb.call paths, signOut, ...).
     */
    private safeInvoke;
    private emitState;
    private emitEvent;
    /** Cache the user + announce sign-in. Session was already set by AuthClient. */
    private adopt;
    /** Adopt a raw palauth AuthResult wire shape: wire tokens, cache user, announce. */
    private adoptWire;
    /** Run a sign-in flow under the signingIn flag to suppress spurious tokenRefreshed. */
    private withSigningIn;
    /**
     * Defensively decode a 200 union body (AuthResult | mfa-required) and
     * complete the flow. The wire contract promises one of the two shapes, but
     * a literal-`null` (or otherwise malformed) JSON body must surface as
     * BackendError('decode') — never a raw TypeError from probing a non-object.
     * The mfa branch validates its fields: `mfa_token` is required; the factor
     * list (named `factors` by magic-link verify, `mfa_factors` by the OAuth
     * callback — extraction-verified against palauth) tolerates a missing or
     * malformed value as []. The signedIn branch validates the FULL AuthResult
     * shape (asWireAuthResult) — an incomplete body falls through to decode,
     * never half-adopts.
     */
    private completeAuthUnion;
    private decodeError;
    signInWithOTP(params: {
        phone: string;
    }): Promise<void>;
    verifyOTP(params: {
        phone: string;
        token: string;
    }): Promise<AuthSuccess>;
    resetPassword(email: string): Promise<void>;
    confirmPasswordReset(params: {
        token: string;
        newPassword: string;
    }): Promise<void>;
    updatePassword(params: {
        currentPassword: string;
        newPassword: string;
    }): Promise<void>;
    /**
     * Give a passwordless account its FIRST password, in-app.
     *
     * For accounts created with a passkey or a social provider: they have no
     * current password, so `updatePassword` cannot serve them — it sends one and
     * the server answers 401. Before this existed the only route was the
     * password-RESET e-mail, which asks someone already signed in to go find
     * their inbox.
     *
     * Requires a RECENT sign-in, not merely a session: a first password is a
     * credential that outlives the rest, so the server answers 403
     * `reauthentication_required` on a stale one — the same gate
     * `registerPasskey` carries. An account that already has a password gets 409
     * `password_already_set`; change it with `updatePassword` instead.
     *
     * The session stays valid — no re-login.
     */
    setPassword(newPassword: string): Promise<void>;
    verifyEmail(params: {
        token: string;
    } | {
        code: string;
        email: string;
    }): Promise<void>;
    resendVerification(email: string): Promise<void>;
    signInWithMagicLink(email: string): Promise<void>;
    verifyMagicLink(token: string): Promise<MagicLinkResult>;
    /**
     * Sign in with a passkey stored for this Environment. No identifier is typed:
     * the browser lists the accounts it holds and the user picks one.
     *
     * Throws when the browser cannot run a ceremony — check `passkeysSupported`
     * first and keep a password or e-mail path beside the button.
     */
    signInWithPasskey(): Promise<AuthSuccess>;
    /**
     * Create an account whose only credential is a passkey — the e-mail is the
     * identifier, the passkey is the credential, and no password ever exists.
     */
    signUpWithPasskey(email: string, displayName?: string): Promise<AuthSuccess>;
    /**
     * Add a passkey to the signed-in account, so the next sign-in is one tap.
     *
     * Rejects with a 403 `reauthentication_required` when the session is not
     * recent: a passkey outlives a password reset, so enrolling one takes more
     * than a valid session.
     */
    registerPasskey(name?: string): Promise<void>;
    /** Whether this browser can run a passkey ceremony at all. */
    get passkeysSupported(): boolean;
    signInWithOAuth(params: {
        provider: OAuthProvider;
        redirectTo?: string;
        /** Set false to skip the browser redirect (popup/manual flows). Default true. */
        redirect?: boolean;
    }): Promise<{
        url: string;
    }>;
    beginOAuth(options: OAuthOptions): Promise<OAuthTransaction>;
    /** Complete with the application's result_code; the provider code stays on the backend. */
    exchangeCodeForSession(params: {
        transactionId: string;
        resultCode: string;
        callbackURL?: string;
    }): Promise<OAuthExchangeResult>;
    completeOAuth(params: {
        transactionId: string;
        resultCode?: string;
        callbackURL?: string;
    }): Promise<OAuthExchangeResult>;
    cancelOAuth(transactionId: string): Promise<void>;
    linkIdentity(options: Omit<OAuthOptions, 'purpose'>): Promise<OAuthTransaction>;
    signInWithGoogle(opts?: {
        redirectTo?: string;
        redirect?: boolean;
    }): Promise<{
        url: string;
    }>;
    signInWithApple(opts?: {
        redirectTo?: string;
        redirect?: boolean;
    }): Promise<{
        url: string;
    }>;
}
/**
 * `pb.auth.permissions` — the caller's live permission set (FR-020 = iOS
 * FR-016…019). Affordance, never authority: it decides what to draw, the
 * server decides what is allowed on every request. Bound to
 * `roles:<projectRef>:<uid>` through the general realtime state path, whose
 * gap→resync and reconnect→rejoin already cover FR-018.
 */
declare class PalbePermissions {
    private readonly rt;
    /** True after an unreadable `values` push; a later `sync_version` alone must not restore a version. */
    private unreadable;
    private set;
    private version;
    private userId;
    private subs;
    private readonly listeners;
    constructor(rt: PalbeRuntime);
    /** Bind to the auth lifecycle. The CURRENT state binds synchronously — a
     * realtime refusal throws to the caller of `pb.auth.permissions`; later
     * transitions bind inside the auth emitter, where a failure is reported
     * rather than swallowed. */
    attach(auth: PalbeAuth): void;
    holds(permission: string): boolean;
    get all(): ReadonlySet<string>;
    get syncVersion(): string;
    onChange(callback: (set: ReadonlySet<string>) => void): Unsubscribe;
    /** `for await (const set of pb.auth.permissions.changes())` — the current set first. */
    changes(): AsyncIterable<ReadonlySet<string>>;
    private bind;
    /** `values` is an array of permission names (NFR-004); anything else is
     * UNREADABLE (null) — treated as "none" for the set, and as "unknown" for the
     * version, never as "none as of version N". */
    private static decode;
    private apply;
}

/** Free-form event property bag (JSON object on the wire). */
type AnalyticsProperties = Record<string, unknown>;
/**
 * Runtime-scoped analytics identity — constructed EAGERLY in `buildRuntime`
 * (cheap: listener wiring only, no I/O) because the X-Distinct-Id header
 * interceptor must stamp every request from the first one, even when
 * `pb.analytics` is never touched (iOS: the resolver is wired at
 * PalBackend init). The facade wraps this state lazily.
 *
 * Auth events: while no facade exists, the state maintains identity only
 * (user id for the header, anon rotation on user-initiated sign-out). Once
 * the facade attaches, it takes over wholesale and adds the ingest
 * side-effects (flush + identify / flush + reset).
 */
declare class AnalyticsState {
    identifiedUserId: string | null;
    /** Set by PalbeAnalytics on construction — delegates auth events to it. */
    facadeAuthHandler: ((event: AuthChangeEvent) => void) | null;
    private anonId;
    private readonly store;
    private readonly idKey;
    private readonly optOutKey;
    constructor(rt: PalbeRuntime);
    /** User id when identified, else the stable anon id. NEVER empty —
     * this is what `identify()` links, so stamping it on every request lets
     * the trace pipeline stitch pre-login activity to the user. */
    distinctId(): string;
    anonymousId(): string;
    rotateAnonymousId(): string;
    isOptedOut(): boolean;
    setOptOut(on: boolean): void;
}
declare class PalbeAnalytics {
    private readonly rt;
    private readonly state;
    private readonly buffer;
    private flushTimer;
    /** Browser → buffer + size/timer flush. Server (no document) → immediate
     * per-call POST, zero timers (nothing leaks into RSC/route handlers). */
    private readonly browser;
    constructor(rt: PalbeRuntime, state: AnalyticsState);
    /** Record an event. Invalid names are dropped (one warn per process). */
    capture(event: string, properties?: AnalyticsProperties): void;
    /** Record a screen view — server-canonical `$screen` + `screen_name`.
     * Validates non-empty only (the live wire at /v1/analytics/screen requires
     * non-empty screen_name; the event-name regex does NOT apply here). */
    screen(name: string, properties?: AnalyticsProperties): void;
    /** Link the current anon id to `userId` and adopt it as the distinct id.
     * Immediate POST (not buffered). Re-identifying a DIFFERENT user
     * auto-resets first (iOS K10) so one anon id never links two users. */
    identify(userId: string, traits?: AnalyticsProperties): void;
    /** Merge distinct id `from` into `to` (identity stitching). Immediate POST. */
    alias(from: string, to: string): void;
    /** Drop the buffer, clear the identified user and rotate the anon id
     * (sign-out hygiene). Callers wanting pending events delivered flush first
     * — the auth binding does. */
    reset(): void;
    /** Persisted GDPR opt-out. Opting out drops anything pending so nothing
     * already-buffered leaks after the user said stop. */
    setOptOut(on: boolean): void;
    /** Drain the buffer to /v1/analytics/batch (≤100 per request, sequential).
     * Resolves when delivery finished; NEVER rejects — failed slices are
     * dropped with one warn per flush. 207 partial-reject is also warned once
     * (fire-and-forget: no retry for already-delivered batches). */
    flush(): Promise<void>;
    private ingest;
    /** iOS PalBackend auth-binding parity: signedIn → flush + identify;
     * userInitiated signedOut → flush + reset; sessionExpired → flush only. */
    private handleAuthEvent;
    private startTimer;
    private cancelTimer;
    private post;
}

export { type UnreadView as $, type AuthUser as A, PalbeAnalytics as B, Chat as C, PalbeAuth as D, PalbeCalls as E, type FlagsView as F, PalbeFlags as G, PalbeMessaging as H, type PalbeOAuthConfig as I, PalbePermissions as J, PalbeRealtime as K, type PresenceState as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, type PalbeConfig as P, RealtimeChannel as Q, type RealtimeConnectionState as R, type RealtimeChannelError as S, type RealtimeHandler as T, type RealtimeStatus as U, type RealtimeStatusSnapshot as V, type RealtimeSubscription as W, type ResolvedMention as X, type ResolvedReply as Y, type SentReceipt as Z, type SignInMethods as _, type RealtimePayload as a, type Unsubscribe as a0, type OAuthResult as a1, PalbePerf as a2, type ChatMember as b, type ChatMessage as c, type PalbeRuntime as d, buildRuntime as e, type AnalyticsProperties as f, type AuthChangeEvent as g, type AuthState as h, type AuthSuccess as i, Call as j, type CallChangeCallback as k, type CallParticipant as l, type CallState as m, type ChatBackend as n, type ChatDraft as o, type ChatKind as p, type ChatMessageKind as q, type ChatRole as r, type ChatState as s, type CommsPrefs as t, type MentionRange as u, type MessageDirection as v, type OAuthOptions as w, type OAuthProvider as x, type OAuthPurpose as y, type OAuthTransaction as z };