import { Auth, User } from 'firebase/auth';
import { FirebaseApp } from 'firebase/app';
import { CueEndpoints, PasswordCredentials, SsoProvider } from './models';
import { ReadonlySignal } from './signal';
export type AuthStateListener = (user: User | null) => void;
export type Unsubscribe = () => void;
export declare class CueAuth {
    private readonly _auth;
    private readonly _endpoints;
    private readonly _userSignal;
    private readonly _tokenSignal;
    private readonly _isSuperAdminSignal;
    private readonly _userIdsSignal;
    private readonly _stopTokenListener;
    /** Reactive auth state — emits the signed-in `User`, or `null` when signed out. */
    readonly user: ReadonlySignal<User | null>;
    /** Reactive Firebase ID token — refreshes automatically; `null` when signed out. */
    readonly token: ReadonlySignal<string | null>;
    /** `true` when the current user has the `superadmin` custom claim. */
    readonly isSuperAdmin: ReadonlySignal<boolean>;
    /** All unique UIDs for the current user (Firebase UID + linked provider UIDs). */
    readonly userIds: ReadonlySignal<string[]>;
    constructor(app: FirebaseApp, useEmulator: boolean | undefined, endpoints: CueEndpoints);
    /** Stop all internal Firebase listeners. Call when the `Cue` instance is no longer needed. */
    destroy(): void;
    /** Sign in with Google or Microsoft via browser popup */
    signIn(provider: SsoProvider): Promise<User>;
    /** Sign in with email and password */
    signIn(provider: 'password', credentials: PasswordCredentials): Promise<User>;
    /**
     * Initiate a redirect-based sign-in (mobile / iframe contexts where popups
     * are blocked). Call `checkRedirectResult()` on the next page load to
     * retrieve the result.
     */
    signInWithRedirect(provider: SsoProvider): Promise<void>;
    /**
     * Retrieve the result of a redirect sign-in. Returns the signed-in `User`
     * or `null` if there is no pending redirect result.
     * Call this once on app startup before showing a sign-in UI.
     */
    checkRedirectResult(): Promise<User | null>;
    /**
     * One-shot async check — returns `true` if the current user has the
     * `superadmin` custom claim. For reactive use, read `cue.auth.isSuperAdmin`
     * (the signal) instead.
     */
    checkSuperAdmin(): Promise<boolean>;
    /** Sign in with a Cue API key. `projectId` is optional — omit it when no project context is available (e.g. admin flows). */
    signInWithApiKey(cueApiKey: string, projectId?: string): Promise<User>;
    /** Sign in with a Firebase custom token (e.g. minted server-side for MCP/OAuth flows). */
    signInWithCustomToken(token: string): Promise<User>;
    /**
     * Mint a short-lived Firebase custom token for the current user, scoped to
     * the same identity as their existing session. Used to bootstrap a second
     * `Cue` instance inside a sandboxed, cross-origin context (e.g. an
     * `srcdoc` iframe hosting AI-generated app HTML) that has no access to the
     * portal's IndexedDB-persisted session — the sandboxed instance calls
     * `signInWithCustomToken` with the returned token instead of relying on
     * restored auth state.
     */
    mintAppSessionToken(): Promise<string>;
    /** Sign out the current user */
    signOut(): Promise<void>;
    /** Currently signed-in user, or null if not authenticated */
    get currentUser(): User | null;
    /** Subscribe to authentication state changes. Returns an unsubscribe function. */
    onAuthStateChanged(listener: AuthStateListener): Unsubscribe;
    /** Get the Firebase ID token for the current user, or null if not authenticated */
    getToken(forceRefresh?: boolean): Promise<string | null>;
    /**
     * Executes a fetch with a Bearer token. On a 401 response the token is
     * force-refreshed and the request is retried once before throwing.
     */
    authenticatedFetch(url: string, init?: RequestInit): Promise<Response>;
    /** Raw Firebase Auth instance, for advanced use cases */
    get firebaseAuth(): Auth;
}