import { BaseTokenAuthProvider } from './auth-base.js';
import type { PasswordSignInResult } from './types.js';
export type NativeAuthFlowProvider = 'google' | 'apple';
export interface NativePkceAuthConfig {
    /**
     * Deep-link redirect URI registered by the app. Must match the auth
     * server's native-client allowlist exactly, e.g.
     * 'roolandroidauth://auth/callback' or 'rooliosauth://auth/callback'.
     */
    redirectUri: string;
    /** Identity provider used when login()/signup() are called without one. */
    defaultProvider?: NativeAuthFlowProvider;
    /**
     * Open a URL in an external system browser (NOT the app webview), e.g.
     * Capacitor's `Browser.open({ url })`. PKCE requires the authorization
     * step to happen outside the app so the app never sees provider secrets.
     */
    openExternal: (url: string) => void | Promise<void>;
}
export declare class NativePkceAuthProvider extends BaseTokenAuthProvider {
    private readonly redirectUri;
    private readonly defaultProvider;
    private readonly openExternal;
    constructor(config: NativePkceAuthConfig);
    /**
     * No synchronous callback to process — the app drives completion via
     * handleRedirect(). Just arm refresh for any persisted session.
     */
    initialize(): boolean;
    /**
     * Begin sign-in. `params.provider` ('google' | 'apple') overrides the
     * default; `params.rvid` is forwarded for signup attribution.
     */
    login(_appName: string, params?: Record<string, string>): Promise<void>;
    /**
     * Same flow as login — the providers don't distinguish signup from login
     * for native, and the auth server creates the account on first sign-in.
     */
    signup(_appName: string, params?: Record<string, string>): Promise<void>;
    /**
     * Complete a sign-in from the deep link the app received (e.g. Capacitor's
     * appUrlOpen). Validates state, exchanges the code + stored verifier at
     * /token, and persists the session. Returns true once signed in.
     */
    handleRedirect(url: string): Promise<boolean>;
    /**
     * Sign in with email + password. No redirect involved — the auth server
     * returns the token set as JSON, which we persist directly.
     *
     * Resolves `signed_in` on success, or `verify_required` when the account's
     * email isn't verified (the server has emailed a magic link). Rejects with
     * a human-readable Error on bad credentials or server failure.
     */
    signInWithPassword(email: string, password: string): Promise<PasswordSignInResult>;
    /**
     * Request a magic sign-in link by email. The server emails a link carrying
     * a verify token; the user completes sign-in by following it, which lands
     * back in the app and is finished via `verify(token)`. Resolves once the
     * email is accepted; rejects with a human-readable Error if the address is
     * rejected (invalid / disposable / unreachable).
     *
     * NOTE: the emailed link is an https URL (`<appsDomain>/?verify=…`), so on
     * native it only re-opens the app if Universal Links / App Links are set up
     * for that domain. Without them the link completes on the website instead.
     */
    requestMagicLink(email: string): Promise<void>;
    private get verifierKey();
    private get stateKey();
    private startPkce;
    protected clearTransientState(): void;
}
//# sourceMappingURL=auth-native.d.ts.map