import type { AuthUser, AuthProvider, PasswordSignInResult } from './types.js';
import type { Logger } from './logger.js';
export interface AuthManagerConfig {
    authUrl: string;
    logger: Logger;
    onAuthStateChanged?: (authenticated: boolean) => void;
    /** External auth provider - when set, delegates all auth to this provider */
    authProvider?: AuthProvider;
}
export declare class AuthManager {
    private provider;
    private authUrl;
    constructor(config: AuthManagerConfig);
    /**
     * Initialize auth manager - should be called on app startup.
     */
    initialize(): boolean;
    /**
     * Check if user is currently authenticated (validates token is usable).
     */
    isAuthenticated(): Promise<boolean>;
    /**
     * Get current access token and rool token.
     * Returns undefined if not authenticated.
     */
    getTokens(): Promise<{
        accessToken: string;
        roolToken: string;
    } | undefined>;
    /**
     * Get auth identity from current session (decoded from token).
     */
    getAuthUser(): AuthUser;
    /**
     * Initiate login.
     * @param appName - The name of the application requesting login (displayed on auth page)
     */
    login(appName: string, params?: Record<string, string>): Promise<void> | void;
    /**
     * Initiate signup.
     * @param appName - The name of the application requesting signup (displayed on auth page)
     */
    signup(appName: string, params?: Record<string, string>): Promise<void> | void;
    /**
     * Complete an email verification flow. Returns true if the user is
     * signed in as a result.
     */
    verify(token: string): Promise<boolean>;
    /**
     * Complete a native deep-link auth callback (PKCE providers). The app calls
     * this from its platform deep-link handler with the full callback URL.
     * Returns true if the user is signed in as a result.
     */
    handleRedirect(url: string): Promise<boolean>;
    /**
     * Sign in with email + password. Resolves `signed_in` or `verify_required`;
     * rejects on bad credentials or if the provider doesn't support it.
     */
    signInWithPassword(email: string, password: string): Promise<PasswordSignInResult>;
    /**
     * Request a magic sign-in link by email. Resolves once accepted; rejects on a
     * bad address or if the provider doesn't support it.
     */
    requestMagicLink(email: string): Promise<void>;
    /**
     * Logout - clear all tokens and state.
     */
    logout(): void;
    /**
     * Set or change the authenticated user's password.
     * Requires a live session (Firebase id token). Throws on error.
     */
    setPassword(password: string): Promise<void>;
    /**
     * Process auth callback from URL fragment.
     * Should be called on page load.
     * @returns true if callback was processed
     */
    processCallback(): boolean;
    /**
     * Destroy auth manager - cleanup resources.
     */
    destroy(): void;
}
//# sourceMappingURL=auth.d.ts.map