import { UserInfo } from 'firebase/auth';
import { FirebaseApp } from 'firebase/app';
import { APIKeyDoc, APIKeyInfo, OrgConsumptionReportDto, OrgCreditsDto, OrgMember, OrganizationData, ProfileSSOAccount } from './models';
import { CueAuth } from './auth';
import { ReadonlySignal } from './signal';
export declare class CueProfile {
    private readonly _auth;
    private readonly _gatewayUrl;
    private readonly _functions;
    private readonly _orgCredits;
    /**
     * Reactive view of the last-fetched org credit pool. Updated automatically
     * by `getOrgCredits()` and by the sync layer after every `previewSync`/
     * `sync`/`computeCredits` call, so consumers that bind to this signal see
     * balance changes (e.g. after an upload) without polling or manually
     * re-fetching. Angular consumers bridge via
     * `effect(() => sig.set(cue.profile.orgCredits.get()))` + `.subscribe(...)`.
     */
    readonly orgCredits: ReadonlySignal<OrgCreditsDto | undefined>;
    constructor(_auth: CueAuth, app: FirebaseApp, useEmulator: boolean, _gatewayUrl: string);
    private _url;
    private _fetch;
    /** Whether the current user has an active API key. */
    hasAPIKey(): Promise<boolean>;
    /** Returns the sign-in methods registered for the current user's email. */
    getSignInMethods(): Promise<string[]>;
    /** Builds a human-readable label from a Firebase UserInfo provider entry. */
    buildProviderLabel(userInfo: UserInfo): string;
    /** Returns SSO accounts linked to the current user (excludes password). */
    getSSOAccounts(): ProfileSSOAccount[];
    /** Links a Google or Microsoft provider to the current account via popup. Returns the new provider label. */
    linkProvider(ssoProvider: string): Promise<string>;
    /** Unlinks a provider from the current account. */
    unlinkProvider(providerId: string): Promise<void>;
    /** Changes the password. Reauthenticates first. */
    updatePassword(currentPassword: string, newPassword: string): Promise<void>;
    /** Adds (sets) a password for an account that currently only uses SSO. */
    addPassword(password: string): Promise<void>;
    /** Requests an e-mail change. Sends a verification e-mail to the new address. */
    updateEmail(newEmail: string, password: string): Promise<void>;
    /** Creates a new API key for the current user. */
    createAPIKey(expiration: string): Promise<APIKeyDoc>;
    /** Revokes the current user's API key. */
    revokeAPIKey(): Promise<void>;
    /** Fetches the current user's existing API key. */
    requestAPIKey(): Promise<APIKeyInfo>;
    /** Returns organizations the current user is a member of. */
    listOrganizations(): Promise<(Pick<OrganizationData, 'id' | 'name'> & {
        isAdmin: boolean;
    })[]>;
    /** Returns all members of the given organisation. Caller must be an org admin or superadmin. */
    getOrgMembers(orgId: string): Promise<OrgMember[]>;
    /** Adds a new member to the organisation. Caller must be an org admin or superadmin. */
    addOrgMember(orgId: string, member: {
        name: string;
        email: string;
        role: 'admin' | 'member';
    }): Promise<void>;
    /** Changes an existing member's role within the organisation. Caller must be an org admin or superadmin. */
    setOrgUserRole(orgId: string, userId: string, role: 'admin' | 'member'): Promise<void>;
    /** Removes a member from the organisation, optionally also removing them from every project they belong to. Caller must be an org admin or superadmin. */
    removeOrgMember(orgId: string, userId: string, removeFromProjects: boolean): Promise<void>;
    /**
     * Returns the organisation's shared credit pool: `purchased`, `consumed`
     * (summed across every project the org owns), and `available`. Caller must
     * be an org admin or superadmin.
     */
    getOrgCredits(orgId: string): Promise<OrgCreditsDto>;
    /**
     * Per-project, per-month consumption breakdown for the org — for reporting/export, not
     * the balance itself (use {@link getOrgCredits} for that). Caller must be an org admin
     * or superadmin.
     */
    getOrgConsumptionReport(orgId: string): Promise<OrgConsumptionReportDto>;
    /** Manual/support credit grant to an organisation's shared pool. Superadmins only — org admins self-serve via `startOrgCheckout`. */
    topUpOrgCredits(orgId: string, amount: number): Promise<void>;
    /**
     * Starts a self-serve Stripe checkout for a one-time credit top-up.
     * Returns the hosted checkout URL to redirect the user to; credits are
     * granted by the backend webhook once payment completes.
     */
    startOrgCheckout(orgId: string, credits: number): Promise<{
        url: string;
    }>;
    /**
     * Opens the Stripe Billing Portal for the organisation (update card, view
     * invoices, cancel the plan). Returns the hosted portal URL. Caller must be
     * an org admin; requires the org to have a Stripe customer.
     */
    startOrgBillingPortal(orgId: string): Promise<{
        url: string;
    }>;
    /**
     * Change an organisation's plan — freemium → custom (first paid plan), or
     * re-quote a plan that's still `pendingPayment`. Prices with the same
     * canonical formula used at signup. Returns a checkout URL for the card
     * flow (redirect the user there); omitted for the invoice flow or a
     * freemium change, which apply immediately.
     *
     * Orgs with an *active* paid subscription must use
     * {@link startOrgBillingPortal} instead — this throws if called on one.
     */
    changeOrgPlan(orgId: string, plan: {
        type: 'freemium' | 'custom';
        monthlySpendChf?: number;
        paymentMethod?: 'card' | 'invoice';
    }): Promise<{
        checkoutUrl?: string;
    }>;
    private _requireUser;
    /**
     * Fetch display name and email for a list of user UIDs.
     * Uses the `getUserInfo` Firebase callable function.
     */
    getUserInfo(uids: string[]): Promise<Record<string, {
        name: string;
        email: string;
    }>>;
    /** Record that the current user has accepted the terms of service. Sets a `terms` custom claim on the token. */
    acceptTerms(version: string): Promise<void>;
    /**
     * Returns the terms version the current user has accepted (e.g. `"v1"`),
     * or `null` if they have not accepted any version yet.
     * Reads from the cached ID token — call after `acceptTerms()` with a
     * force-refreshed token to see the updated value.
     */
    latestTermsAccepted(): Promise<string | null>;
}