import type { AuthProvider, AuthUser } from './types.js';
import { type Logger } from './logger.js';
export interface BaseTokenAuthConfig {
    /** Auth URL (e.g. https://rool.dev/auth). Injected by RoolClient if omitted. */
    authUrl?: string;
    /** Injected by RoolClient if omitted. */
    logger?: Logger;
    /** Injected by RoolClient if omitted, so auth-state reaches client events. */
    onAuthStateChanged?: (authenticated: boolean) => void;
}
export declare abstract class BaseTokenAuthProvider implements AuthProvider {
    protected logger: Logger;
    private _authUrl;
    private _onAuthStateChanged;
    private refreshPromise;
    private refreshTimeoutId;
    private boundVisibilityHandler;
    constructor(config?: BaseTokenAuthConfig);
    setAuthUrl(url: string): void;
    setLogger(logger: Logger): void;
    setAuthStateChangedHandler(handler: (authenticated: boolean) => void): void;
    abstract initialize(): boolean;
    abstract login(appName: string, params?: Record<string, string>): Promise<void> | void;
    abstract signup(appName: string, params?: Record<string, string>): Promise<void> | void;
    /**
     * Check if user is currently authenticated.
     *
     * This reports identity (do we hold credentials), NOT server reachability.
     * It deliberately does not perform a network refresh: a backend outage must
     * not read as "logged out". A genuinely invalid/expired refresh token
     * surfaces later as a 401 on first real use, which clears tokens and fires
     * onAuthStateChanged(false) — the only path that ends the session.
     */
    isAuthenticated(): Promise<boolean>;
    /**
     * Get current access token and rool token, refreshing if expired.
     * Returns undefined if not authenticated.
     */
    getTokens(): Promise<{
        accessToken: string;
        roolToken: string;
    } | undefined>;
    /**
     * Get auth identity decoded from JWT token.
     */
    getAuthUser(): AuthUser;
    /**
     * Complete an email verification flow. Exchanges a verify JWT (from the
     * verification email link) for a fresh token set and signs the user in.
     */
    verify(token: string): Promise<boolean>;
    /**
     * Logout - clear all tokens and state.
     */
    logout(): void;
    /**
     * Destroy auth manager - clear refresh timers and listeners.
     */
    destroy(): void;
    /** Auth URL without trailing slash */
    protected get authBaseUrl(): string;
    protected notifyAuthState(authenticated: boolean): void;
    /** Persist a fresh token set and (re)arm the background refresh timer. */
    protected acceptTokens(accessToken: string, refreshToken: string | null, roolToken: string | null, expiresAt: number): void;
    /** Arm auto-refresh + visibility re-scheduling. Call from initialize(). */
    protected initBase(): void;
    /**
     * Overridable hook: clear subclass-owned transient state on logout/cancel
     * (e.g. an in-flight OAuth `state` or PKCE verifier). No-op by default.
     */
    protected clearTransientState(): void;
    protected get storagePrefix(): string;
    /** Build a storage key scoped to this auth endpoint. */
    protected keyFor(name: string): string;
    protected get storageKeys(): {
        readonly access: `${string}access_token`;
        readonly refresh: `${string}refresh_token`;
        readonly rool: `${string}rool_token`;
        readonly expiresAt: `${string}token_expires_at`;
    };
    protected readString(key: string): string | null;
    protected writeString(key: string, value: string): void;
    protected removeString(key: string): void;
    protected scheduleTokenRefresh(): void;
    protected writeTokens(accessToken: string | null, refreshToken: string | null, expiresAt: number | null): void;
    protected writeRoolToken(token: string | null): void;
    protected clearTokens(): void;
    protected readAccessToken(): string | null;
    protected readRoolToken(): string;
    protected readExpiresAt(): number | null;
    /**
     * Get a short hash of the auth URL for scoping storage by endpoint.
     */
    private get endpointHash();
    private tryRefreshToken;
    private listenForVisibility;
    private cancelScheduledRefresh;
    private decodeAuthUser;
}
//# sourceMappingURL=auth-base.d.ts.map