import { default as AuthProvider, AuthBootstrap, AuthEventListener } from './AuthProvider';
import { AuthProviderSettings } from './types';
import { AuthFailureReason, AuthState, LoginResult, TokenResult } from '@plitzi/sdk-shared';
export type AuthProviderFactory<U = Record<string, unknown>> = (settings: AuthProviderSettings) => AuthProvider<U>;
/**
 * Adds an auth provider a space can then select by name in its settings. Spaces run against whichever backend their
 * owner has — `basic` covers any HTTP+JSON API by configuration alone, and this is the way out for the ones it does
 * not: register before the SDK mounts, and `userProvider: '<name>'` picks it up.
 */
export declare const registerAuthProvider: <U = Record<string, unknown>>(name: string, factory: AuthProviderFactory<U>) => void;
export declare const getAuthProviderNames: () => string[];
/**
 * Holds the provider a space selected and forwards to it. Its reason for existing is that the provider is chosen at
 * runtime from the schema: everything above this line talks to one object whether the space authenticates against
 * Plitzi, against Auth0, or against something the customer registered.
 */
export declare class AuthManager<U = Record<string, unknown>> {
    private readonly providerType;
    private readonly provider?;
    private readonly settings;
    private readonly listeners;
    constructor(providerType: string, listeners: AuthEventListener | AuthEventListener[], settings: AuthProviderSettings);
    getProviderType(): string;
    getProvider(): AuthProvider<U> | undefined;
    getState(): AuthState;
    /**
     * What this browser can be seen to hold before anything has run.
     *
     * Answered even when no provider has been named yet, which is the state every page is in while its schema loads:
     * where the credential is kept is a matter of settings — the storage key, the hint cookie — and not of which
     * provider will end up using it, so it can be read now. Doing that read only after the schema arrived is what
     * made a signed-in page paint its signed-out version first on every reload.
     */
    peekState(): AuthState;
    peek(): {
        state: AuthState;
        user?: U;
        token?: TokenResult;
    };
    can(permission: string): boolean;
    /**
     * A space that names no provider — a widget, an offline render, anything that does not sign people in — has no
     * session to settle, and must say so. Without this it never reports a state at all, and a caller waiting for one
     * (the SDK holds its whole tree back until auth has decided) waits forever and renders nothing.
     *
     * What it must not say is that nobody is signed in when the server just rendered this page for somebody. There are
     * two ways to arrive here holding a bootstrap: a space that genuinely names no provider, and — the common one — a
     * space whose schema has not loaded yet, because `userProvider` is read from it and is empty for the first render
     * of every page that fetches its schema over the network. Answering `guest` there contradicted the HTML that had
     * just been sent: the page flipped to its signed-out version, then back once the schema arrived and a real
     * provider adopted the same identity. The server's answer stands until something that can actually check it
     * disagrees.
     */
    init(bootstrap?: AuthBootstrap<U>): Promise<void>;
    /**
     * With no provider there is nothing to sign in against, which is a refusal like any other — and has to say so, to
     * the page and to whoever is reading its console: `missing` alone looks exactly like a form left empty.
     */
    login(...args: Parameters<AuthProvider<U>['login']>): Promise<LoginResult>;
    refresh(): Promise<TokenResult | undefined>;
    revalidate(force?: boolean): Promise<boolean>;
    invalidate(reason?: AuthFailureReason): void;
    logout(): Promise<void>;
    dispose(): void;
    on(listener: AuthEventListener): (() => void) | undefined;
}