/**
 * Configuration for a Stytch project. This represents aspects of project
 * configuration that are controlled via the Stytch dashboard, but affect SDK
 * behavior. You can extend from this type for improved type safety when
 * creating your own project configuration.
 *
 * To specify a default project configuration for your entire project, augment
 * {@link Stytch.DefaultProjectConfiguration} via declaration merging. For more
 * advanced use cases, many types accept `StytchProjectConfiguration` as a
 * generic type parameter directly.
 *
 * This type is equivalent to the `Stytch.ProjectConfiguration` type, which is
 * defined in the `Stytch` namespace for convenience.
 *
 * @example
 * interface MyProjectConfiguration extends ProjectConfiguration {
 *   OpaqueTokens: true;
 * }
 *
 * const client = new StytchClient<MyProjectConfiguration>(...);
 */
interface StytchProjectConfiguration {
    /**
     * Whether sensitive tokens are omitted from response bodies. Set this to true
     * when HttpOnly cookies are enforced for the project.
     */
    OpaqueTokens: boolean;
}
type StytchProjectConfigurationInput = Partial<StytchProjectConfiguration>;
type BooleanOption<TInput extends boolean, TTrue, TFalse> = TInput extends true ? TTrue : TInput extends false ? TFalse : TTrue | TFalse;
type ReadProjectConfig<TKey extends keyof StytchProjectConfiguration, TUserConfig extends StytchProjectConfigurationInput, TDefaultValue = Stytch.DefaultProjectConfiguration[TKey]> = TUserConfig[TKey] extends StytchProjectConfiguration[TKey] ? TUserConfig[TKey] : TDefaultValue;
type ExtractOpaqueTokens<TProjectConfiguration extends StytchProjectConfigurationInput> = ReadProjectConfig<"OpaqueTokens", TProjectConfiguration>;
type AllowedOpaqueTokens = ExtractOpaqueTokens<StytchProjectConfigurationInput>;
type IfOpaqueTokens<TIsOpaque extends boolean, TWhenOpaque, TWhenReadable> = BooleanOption<TIsOpaque, TWhenOpaque, TWhenReadable>;
type RedactedToken = "";
type Redacted<T, V> = {
    [K in keyof T]: V;
};
type StringLiteralFromEnum<T extends string> = `${T}`;
type EnumOrStringLiteral<T extends string> = T | StringLiteralFromEnum<T>;
declare global {
    // The telemetry.js script will set a global function called GetTelemetryID on the window
    // object. This interface is allows us to call that function while pleasing the TypeScript
    // compiler.
    interface Window {
        GetTelemetryID: (publicToken: string, submitURL: string) => Promise<string>;
    }
}
type DFPProtectedAuthMode = "OBSERVATION" | "DECISIONING";
declare const VERTICAL_B2B = "B2B";
declare const VERTICAL_CONSUMER = "CONSUMER";
type Vertical = typeof VERTICAL_B2B | typeof VERTICAL_CONSUMER;
type RBACPolicyRole = {
    role_id: string;
    description: string;
    permissions: {
        resource_id: string;
        actions: string[];
    }[];
};
type RBACPolicyScope = {
    scope: string;
    description: string;
    permissions: {
        resource_id: string;
        actions: string[];
    }[];
};
type RBACPolicyResource = {
    resource_id: string;
    description: string;
    actions: string[];
};
type RBACPolicyRaw = {
    roles: RBACPolicyRole[];
    resources: RBACPolicyResource[];
    scopes: RBACPolicyScope[];
};
type BootstrapData = {
    projectName: string | null;
    displayWatermark: boolean;
    cnameDomain: string | null;
    emailDomains: string[];
    captchaSettings: {
        enabled: false;
    } | {
        enabled: true;
        siteKey: string;
    };
    pkceRequiredForEmailMagicLinks: boolean;
    pkceRequiredForPasswordResets: boolean;
    pkceRequiredForOAuth: boolean;
    pkceRequiredForSso: boolean;
    slugPattern: string | null;
    createOrganizationEnabled: boolean;
    passwordConfig: {
        ludsComplexity: number;
        ludsMinimumCount: number;
    } | null;
    runDFPProtectedAuth: boolean;
    dfpProtectedAuthMode?: DFPProtectedAuthMode;
    rbacPolicy: RBACPolicyRaw | null;
    siweRequiredForCryptoWallets: boolean;
    vertical: Vertical | null;
};
type SessionUpdateOptions = {
    /**
     * If the authenticate method was called with session_duration_minutes, this property will
     * be set. This is mainly used for the keepSessionAlive option.
     */
    sessionDurationMinutes?: number;
};
// Factors
interface EmailFactor {
    delivery_method: "email" | "embedded";
    type: string;
    last_authenticated_at: string;
    email_factor: {
        email_id: string;
        email_address: string;
    };
}
interface PhoneNumberFactor {
    delivery_method: "sms" | "whatsapp";
    type: string;
    last_authenticated_at: string;
    phone_number_factor: {
        phone_id: string;
        phone_number: string;
    };
}
interface GoogleOAuthFactor {
    delivery_method: "oauth_google";
    type: string;
    last_authenticated_at: string;
    google_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface MicrosoftOAuthFactor {
    delivery_method: "oauth_microsoft";
    type: string;
    last_authenticated_at: string;
    microsoft_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface AppleOAuthFactor {
    delivery_method: "oauth_apple";
    type: string;
    last_authenticated_at: string;
    apple_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface GithubOAuthFactor {
    delivery_method: "oauth_github";
    type: string;
    last_authenticated_at: string;
    github_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface GitLabOAuthFactor {
    delivery_method: "oauth_gitlab";
    type: string;
    last_authenticated_at: string;
    gitlab_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface FacebookOAuthFactor {
    delivery_method: "oauth_facebook";
    type: string;
    last_authenticated_at: string;
    facebook_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface DiscordOAuthFactor {
    delivery_method: "oauth_discord";
    type: string;
    last_authenticated_at: string;
    discord_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface SalesforceOAuthFactor {
    delivery_method: "oauth_salesforce";
    type: string;
    last_authenticated_at: string;
    salesforce_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface SlackOAuthFactor {
    delivery_method: "oauth_slack";
    type: string;
    last_authenticated_at: string;
    slack_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface AmazonOAuthFactor {
    delivery_method: "oauth_amazon";
    type: string;
    last_authenticated_at: string;
    amazon_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface BitbucketOAuthFactor {
    delivery_method: "oauth_bitbucket";
    type: string;
    last_authenticated_at: string;
    bitbucket_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface LinkedInOAuthFactor {
    delivery_method: "oauth_linkedin";
    type: string;
    last_authenticated_at: string;
    linkedin_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface CoinbaseOAuthFactor {
    delivery_method: "oauth_coinbase";
    type: string;
    last_authenticated_at: string;
    coinbase_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface TwitchOAuthFactor {
    delivery_method: "oauth_twitch";
    type: string;
    last_authenticated_at: string;
    twitch_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface TwitterOAuthFactor {
    delivery_method: "oauth_twitter";
    type: string;
    last_authenticated_at: string;
    twitter_oauth_factor: {
        id: string;
        provider_subject: string;
    };
}
interface TikTokOAuthFactor {
    delivery_method: "oauth_tiktok";
    type: string;
    last_authenticated_at: string;
    tiktok_oauth_factor: {
        id: string;
        provider_subject: string;
    };
}
interface FigmaOAuthFactor {
    delivery_method: "oauth_figma";
    type: string;
    last_authenticated_at: string;
    figma_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface SnapchatOAuthFactor {
    delivery_method: "oauth_snapchat";
    type: string;
    last_authenticated_at: string;
    snapchat_oauth_factor: {
        id: string;
        provider_subject: string;
    };
}
interface YahooOAuthFactor {
    delivery_method: "oauth_yahoo";
    type: string;
    last_authenticated_at: string;
    yahoo_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
}
interface WebAuthnFactor {
    delivery_method: "webauthn_registration";
    type: string;
    last_authenticated_at: string;
    webauthn_factor: {
        webauthn_registration_id: string;
        domain: string;
        user_agent: string;
    };
}
interface AuthenticatorAppFactor {
    delivery_method: "authenticator_app";
    type: string;
    last_authenticated_at: string;
    authenticator_app_factor: {
        totp_id: string;
    };
}
interface RecoveryCodeFactor {
    delivery_method: "recovery_code";
    type: string;
    last_authenticated_at: string;
    recovery_code_factor: {
        totp_recovery_code_id: string;
    };
}
interface CryptoWalletFactor {
    delivery_method: "crypto_wallet";
    type: string;
    last_authenticated_at: string;
    crypto_wallet_factor: {
        crypto_wallet_id: string;
        crypto_wallet_address: string;
        crypto_wallet_type: string;
    };
}
interface PasswordFactor {
    delivery_method: "knowledge";
    type: string;
    last_authenticated_at: string;
}
interface BiometricFactor {
    delivery_method: "biometric";
    type: string;
    last_authenticated_at: string;
    biometric_factor: {
        biometric_registration_id: string;
    };
}
interface AccessTokenExchangeFactor {
    delivery_method: "oauth_access_token_exchange";
    type: string;
    last_authenticated_at: string;
    oauth_access_token_exchange_factor: {
        client_id: string;
    };
}
type AuthenticationFactor = EmailFactor | PhoneNumberFactor | GoogleOAuthFactor | MicrosoftOAuthFactor | AppleOAuthFactor | GithubOAuthFactor | GitLabOAuthFactor | FacebookOAuthFactor | DiscordOAuthFactor | SalesforceOAuthFactor | SlackOAuthFactor | AmazonOAuthFactor | BitbucketOAuthFactor | LinkedInOAuthFactor | CoinbaseOAuthFactor | TwitchOAuthFactor | TwitterOAuthFactor | TikTokOAuthFactor | SnapchatOAuthFactor | FigmaOAuthFactor | YahooOAuthFactor | WebAuthnFactor | AuthenticatorAppFactor | RecoveryCodeFactor | CryptoWalletFactor | PasswordFactor | BiometricFactor | AccessTokenExchangeFactor;
type Session = {
    attributes: {
        ip_address: string;
        user_agent: string;
    };
    /**
     * All the authentication factors that have been associated with the current session.
     * @example
     * const userIsMFAd = session.authentication_factors.length > 2;
     */
    authentication_factors: AuthenticationFactor[];
    /**
     * The timestamp of the session's expiration.
     * Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    expires_at: string;
    /**
     * The timestamp of the last time the session was accessed.
     * Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    last_accessed_at: string;
    /**
     * Globally unique UUID that identifies a specific session in the Stytch API.
     */
    session_id: string;
    /**
     * The timestamp of the session's creation.
     * Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    started_at: string;
    /**
     * Globally unique UUID that identifies a specific user in the Stytch API.
     */
    user_id: string;
    /**
     * A map of the custom claims associated with the session.
     * Custom claims can only be set from the server, they cannot be set using the clientside SDKs.
     * After claims have been added to a session, call {@link IHeadlessSessionClient#authenticate stytch.session.authenticate} to refresh the session state clientside.
     * See our {@link https://stytch.com/docs/sessions#using-sessions_custom-claims guide} for more information.
     * If no claims are set, this field will be null.
     */
    custom_claims: null | Record<string, unknown>;
    /**
     * A list of the roles associated with the session.
     */
    roles: string[];
};
type SessionTokensUpdate = {
    /**
     * An opaque session token.
     * Session tokens need to be authenticated via the {@link https://stytch.com/docs/api/session-auth SessionsAuthenticate}
     * endpoint before a user takes any action that requires authentication
     * See {@link https://stytch.com/docs/sessions#session-tokens-vs-JWTs_tokens our documentation} for more information.
     */
    session_token: string;
    /**
     * A JSON Web Token that contains standard claims about the user as well as information about the Stytch session
     * Session JWTs can be authenticated locally without an API call.
     * A session JWT is signed by project-specific keys stored by Stytch.
     * You can retrieve your project's public keyset via our {@link https://stytch.com/docs/api/jwks-get GetJWKS} endpoint
     * See {@link https://stytch.com/docs/sessions#session-tokens-vs-JWTs_jwts our documentation} for more information.
     */
    session_jwt?: string | null;
};
type ResponseCommon = {
    /**
     * Globally unique UUID that is returned with every API call.
     * This value is important to log for debugging purposes;
     * Stytch may ask for this value to help identify a specific API call when helping you debug an issue.
     */
    request_id: string;
    /**
     * The HTTP status code of the response.
     * Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success,
     * 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
     */
    status_code: number;
};
type User = {
    /**
     * The timestamp of the user's creation.
     * Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    created_at: string;
    /**
     * The `crypto_wallets` array contains a list of all crypto wallets that a user has linked via Stytch.
     */
    crypto_wallets: {
        /**
         * Globally unique UUID that identifies a specific crypto wallet in the Stytch API.
         * The `crypto_wallet_id` is used when you need to operate on a specific user's crypto wallet, e.g. to remove the crypto wallet from the Stytch user.
         */
        crypto_wallet_id: string;
        /**
         * The `crypto_wallet_address` is the actual blockchain address of this user's crypto wallet.
         */
        crypto_wallet_address: string;
        /**
         * The `crypto_wallet_type` is the blockchain that the user's crypto wallet operates on, e.g. Ethereum, Solana, etc.
         */
        crypto_wallet_type: string;
        /**
         * The `verified` boolean denotes whether or not this method has been successfully authenticated by the user.
         */
        verified: boolean;
    }[];
    /**
     * The `emails` array contains an array of `email` objects for the user.
     */
    emails: {
        /**
         * The email address.
         */
        email: string;
        /**
         * Globally unique UUID that identifies a specific email address in the Stytch API.
         * The `email_id` is used when you need to operate on a specific user's email address,
         * e.g. to delete the email address from the Stytch user.
         */
        email_id: string;
        /**
         * The `verified` boolean denotes whether or not this method has been successfully authenticated by the user.
         */
        verified: boolean;
    }[];
    name: {
        first_name: string;
        last_name: string;
        middle_name: string;
    };
    /**
     * A JSON object containing application-specific metadata.
     * This field can only be updated by a direct API integration.
     * Use it to store fields that a user should not be allowed to edit without backend validation - such as `role` or `subscription_status`.
     * See our {@link https://stytch.com/docs/api/metadata metadata reference} for complete details.
     */
    trusted_metadata: Record<string, unknown>;
    /**
     * A JSON object containing application-specific metadata.
     * Use it to store fields that a user can be allowed to edit directly without backend validation - such as `display_theme` or `preferred_locale`.
     * See our {@link https://stytch.com/docs/api/metadata metadata reference} for complete details.
     */
    untrusted_metadata: Record<string, unknown>;
    /**
     * The `phone_numbers` array contains an array of phone number objects for the user.
     */
    phone_numbers: {
        /**
         * A phone number.
         */
        phone_number: string;
        /**
         * Globally unique UUID that identifies a specific phone number in the Stytch API.
         * The `phone_id` is used when you need to operate on a specific user's phone number,
         * e.g. to delete the phone number from the Stytch user.
         */
        phone_id: string;
        /**
         * The `verified` boolean denotes whether or not this method has been successfully authenticated by the user.
         */
        verified: boolean;
    }[];
    /**
     * The `providers` array contains an array of provider objects for the user, i.e. which OAuth providers the user has used to link their account.
     */
    providers: {
        /**
         * Globally unique UUID that identifies singluar registration of a user with an OAuth identity provider in the Stytch API.
         */
        oauth_user_registration_id: string;
        /**
         * The `provider_subject` field is the unique identifier used to identify the user within a given OAuth provider.
         * Also commonly called the "sub" or "Subject field" in OAuth protocols.
         */
        provider_subject: string;
        /**
         * The `type` field denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc.
         */
        provider_type: string;
        /**
         * If available, the `profile_picture_url` is a url of the user's profile picture set in OAuth identity the provider that the user has authenticated with, e.g. Facebook profile picture.
         */
        profile_picture_url: string;
        /**
         * If available, the `locale` is the user's locale set in the OAuth identity provider that the user has authenticated with.
         */
        locale: string;
    }[];
    /**
     * The `password` object is returned for users with a password.
     */
    password: null | {
        /**
         * Globally unique UUID that identifies a specific password in the Stytch API.
         */
        password_id: string;
        /**
         * The `requires_reset` field indicates whether the user will need to reset their password to use it in the future.
         * See {@link https://stytch.com/docs/api/password-authenticate the API docs} for explanations of scenarios where
         * this might be required.
         */
        requires_reset: boolean;
    };
    /**
     * The `status` value denotes whether or not a user has successfully logged in at least once with any available login method.
     * Possible values are `active` and `pending`.
     */
    status: "active" | "pending";
    /**
     * The `totps` array contains a list of all TOTP instances for a given user in the Stytch API.
     */
    totps: {
        /**
         * Globally unique UUID that identifies a specific TOTP instance in the Stytch API.
         * The `totp_id` is used when you need to operate on a specific user's TOTP instance, e.g. to delete the TOTP instance from the Stytch user.
         */
        totp_id: string;
        /**
         * The `verified` boolean denotes whether or not this method has been successfully authenticated by the user.
         */
        verified: boolean;
    }[];
    /**
     * Globally unique UUID that identifies a specific user in the Stytch API.
     * The user_id critical to perform operations on a user in our API, like Get user, Delete user, etc,
     * so be sure to preserve this value.
     */
    user_id: string;
    /**
     * The `webauthn_registrations` array contains a list of all WebAuthn registrations for a given user in the Stytch API.
     */
    webauthn_registrations: WebAuthnRegistration[];
    /**
     * The `biometric_registrations` array contains a list of all Biometric registrations for a given user in the Stytch API.
     */
    biometric_registrations: {
        /**
         * Globally unique UUID that identifies a specific Biometric registration in the Stytch API.
         * The `biometric_registration_id` is used when you need to operate on a specific user's Biometric registration,
         * e.g. to delete the Biometric instance from the Stytch user.
         */
        biometric_registration_id: string;
        /**
         * The `verified` boolean denotes whether or not this method has been successfully authenticated by the user.
         */
        verified: boolean;
    }[];
    /**
     * The `roles` array contains a list of all roles assigned to a given user in the Stytch API.
     */
    roles: string[];
    /**
     * The external ID of the user.
     */
    external_id?: string;
};
type WebAuthnRegistration = {
    /**
     * The `domain` on which a WebAuthn registration was started.
     * This will be the domain of your app.
     */
    domain: string;
    /**
     * The `user_agent` of the user's browser or device.
     */
    user_agent: string;
    /**
     * The `authenticator_type` string displays the requested authenticator type of the WebAuthn device.
     * The two valid types are "platform" and "cross-platform".
     * If no value is present, the WebAuthn device was created without an authenticator type preference.
     */
    authenticator_type: string;
    /**
     * The `verified` boolean denotes whether or not this method has been successfully authenticated by the user.
     */
    verified: boolean;
    /**
     * Globally unique UUID that identifies a specific WebAuthn registration in the Stytch API.
     * The `webauthn_registration_id` is used when you need to operate on a specific user's WebAuthn registration,
     * e.g. to delete the WebAuthn instance from the Stytch user.
     */
    webauthn_registration_id: string;
    /**
     * The name of the WebAuthn device. We randomly generate the field to begin with but you can update it to a
     * custom value via the {@link https://stytch.com/docs/api/webauthn-update WebAuthnUpdate} endpoint.
     */
    name: string;
};
type SessionTokens$0 = {
    /**
     * An opaque session token.
     * Session tokens need to be authenticated via the {@link https://stytch.com/docs/api/session-auth SessionsAuthenticate}
     * endpoint before a user takes any action that requires authentication
     * See {@link https://stytch.com/docs/sessions#session-tokens-vs-JWTs_tokens our documentation} for more information.
     */
    session_token: string;
    /**
     * A JSON Web Token that contains standard claims about the user as well as information about the Stytch session
     * Session JWTs can be authenticated locally without an API call.
     * A session JWT is signed by project-specific keys stored by Stytch.
     * You can retrieve your project's public keyset via our {@link https://stytch.com/docs/api/jwks-get GetJWKS} endpoint
     * See {@link https://stytch.com/docs/sessions#session-tokens-vs-JWTs_jwts our documentation} for more information.
     */
    session_jwt: string;
};
type AuthenticateResponse<TProjectConfiguration extends StytchProjectConfigurationInput = Stytch.DefaultProjectConfiguration> = ResponseCommon & {
    /**
     * Globally unique UUID that identifies a specific user in the Stytch API.
     * The user_id critical to perform operations on a user in our API, like Get user, Delete user, etc,
     * so be sure to preserve this value.
     */
    user_id: string;
    /**
     * The Session object created.
     * See {@link Session} for details.
     */
    session: Session;
    /**
     * The user object affected by this API call.
     * See the {@link https://stytch.com/docs/api/get-user Get user} endpiont for complete response field detail.
     */
    user: User;
} & IfOpaqueTokens<ExtractOpaqueTokens<TProjectConfiguration>, Redacted<SessionTokens$0, RedactedToken>, SessionTokens$0>;
type UnsubscribeFunction = () => void;
type ConsumerState = {
    user?: User;
    session?: Session;
};
// Authentication Factors
interface B2BEmailFactor {
    delivery_method: "email";
    type: string;
    last_authenticated_at: string;
    email_factor: {
        email_id: string;
        email_address: string;
    };
    sequence_order: "PRIMARY";
}
interface B2BPhoneNumberFactor {
    delivery_method: "sms" | "whatsapp";
    type: string;
    last_authenticated_at: string;
    phone_number_factor: {
        phone_id: string;
        phone_number: string;
    };
    sequence_order: "SECONDARY";
}
interface B2BGoogleOAuthFactor {
    delivery_method: "oauth_google";
    type: string;
    last_authenticated_at: string;
    google_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
    sequence_order: "PRIMARY";
}
interface B2BMicrosoftOAuthFactor {
    delivery_method: "oauth_microsoft";
    type: string;
    last_authenticated_at: string;
    microsoft_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
    };
    sequence_order: "PRIMARY";
}
interface B2BHubSpotOAuthFactor {
    delivery_method: "oauth_hubspot";
    type: string;
    last_authenticated_at: string;
    hubspot_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
        provider_tenant_id?: string;
    };
    sequence_order: "PRIMARY";
}
interface B2BSlackOAuthFactor {
    delivery_method: "oauth_slack";
    type: string;
    last_authenticated_at: string;
    slack_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
        provider_tenant_id?: string;
    };
    sequence_order: "PRIMARY";
}
interface B2BGitHubOAuthFactor {
    delivery_method: "oauth_github";
    type: string;
    last_authenticated_at: string;
    github_oauth_factor: {
        id: string;
        email_id: string;
        provider_subject: string;
        provider_tenant_ids?: string[];
    };
    sequence_order: "PRIMARY";
}
type B2BAuthenticationFactor = B2BEmailFactor | B2BPhoneNumberFactor | B2BGoogleOAuthFactor | B2BMicrosoftOAuthFactor | B2BHubSpotOAuthFactor | B2BSlackOAuthFactor | B2BGitHubOAuthFactor;
interface MemberSession {
    /**
     * Globally unique UUID that identifies a specific member session in the Stytch API.
     */
    member_session_id: string;
    /**
     * Globally unique UUID that identifies a specific member in the Stytch API.
     * The member_id critical to perform operations on a member in our API
     * so be sure to preserve this value.
     */
    member_id: string;
    /**
     * Globally unique UUID that identifies an organization in the Stytch API.
     */
    organization_id: string;
    /**
     * The timestamp of the session's creation.
     * Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    started_at: string;
    /**
     * The timestamp of the last time the session was accessed.
     * Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    last_accessed_at: string;
    /**
     * The timestamp of the session's expiration.
     * Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    expires_at: string;
    /**
     * All the authentication factors that have been associated with the current member session.
     */
    authentication_factors: B2BAuthenticationFactor[];
    /**
     * A map of the custom claims associated with the session.
     * Custom claims can only be set from the server, they cannot be set using the clientside SDKs.
     * After claims have been added to a session, call {@link IHeadlessB2BSessionClient#authenticate stytch.session.authenticate} to refresh the session state clientside.
     * See our {@link https://stytch.com/docs/sessions#using-sessions_custom-claims guide} for more information.
     * If no claims are set, this field will be null.
     */
    custom_claims?: Record<string, unknown>;
    /**
     * A list of the roles associated with the session.
     * Members may inherit certain roles depending on the factors in their session.
     * For example, some roles may only be active if the member logged in from a specific SAML IDP.
     */
    roles: string[];
    /**
     * The slug of the organization that the member belongs to.
     */
    organization_slug: string;
}
interface SSORegistration {
    connection_id: string;
    external_id: string;
    registration_id: string;
    sso_attributes: Record<string, unknown>;
}
interface OAuthRegistration {
    /**
     * Globally unique UUID that identifies a specific member OAuth registration in the Stytch API.
     */
    member_oauth_registration_id: string;
    /**
     * The `provider_subject` field is the unique identifier used to identify the user within a given OAuth provider.
     * Also commonly called the "sub" or "Subject field" in OAuth protocols.
     */
    provider_subject: string;
    /**
     * The `type` field denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc.
     */
    provider_type: string;
    /**
     * If available, the `profile_picture_url` is a url of the user's profile picture set in OAuth identity the provider that the user has authenticated with, e.g. Facebook profile picture.
     */
    profile_picture_url: string | null;
    /**
     * If available, the `locale` is the user's locale set in the OAuth identity provider that the user has authenticated with.
     */
    locale: string | null;
    /**
     * A list of known tenants associated with the provider.
     */
    provider_tenants: {
        /**
         * The ID of the tenant assigned by the provider.
         */
        tenant_id: string;
        /**
         * The name of the tenant.
         */
        tenant_name: string;
    }[];
}
type RoleSource = {
    type: "direct_assignment";
    details: Record<string, never>;
} | {
    type: "email_assignment";
    details: {
        email_domain: string;
    };
} | {
    type: "sso_connection";
    details: {
        connection_id: string;
    };
} | {
    type: "sso_connection_group";
    details: {
        connection_id: string;
        group: string;
    };
} | {
    type: "scim_connection_group";
    details: {
        connection_id: string;
        group_id: string;
    };
};
interface MemberRole {
    role_id: string;
    sources: RoleSource[];
}
interface RetiredEmailAddress {
    email_id?: string;
    email_address?: string;
}
interface Member {
    /**
     * Globally unique UUID that identifies an organization in the Stytch API.
     */
    organization_id: string;
    /**
     * Globally unique UUID that identifies a specific member in the Stytch API.
     * The member_id critical to perform operations on a member in our API
     * so be sure to preserve this value.
     */
    member_id: string;
    /**
     * The email address of the member.
     */
    email_address: string;
    /**
     * Whether the member's email address is verified.
     */
    email_address_verified: boolean;
    /**
     * A list of retired email addresses associated with the Member, if any exist.
     */
    retired_email_addresses: RetiredEmailAddress[];
    /**
     * The `status` value denotes whether or not a user has successfully logged in at least once with any available login method.
     */
    status: string;
    /**
     * The name of the member
     */
    name: string;
    /**
     * A JSON object containing application-specific metadata.
     * This field can only be updated by a direct API integration.
     * Use it to store fields that a member should not be allowed to edit without backend validation - such as `role` or `subscription_status`.
     * See our {@link https://stytch.com/docs/api/metadata metadata reference} for complete details.
     */
    trusted_metadata: Record<string, unknown>;
    /**
     * A JSON object containing application-specific metadata.
     * Use it to store fields that a member can be allowed to edit directly without backend validation - such as `display_theme` or `preferred_locale`.
     * See our {@link https://stytch.com/docs/api/metadata metadata reference} for complete details.
     */
    untrusted_metadata: Record<string, unknown>;
    /**
     * The timestamp of the Member's creation. Values conform to the RFC 3339 standard and are expressed in
     * UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    created_at: string;
    /**
     * The timestamp of when the Member was last updated. Values conform to the RFC 3339 standard and are
     * expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
     */
    updated_at: string;
    sso_registrations: SSORegistration[];
    /**
     * Identifies the Member as a break glass user - someone who has permissions to authenticate into an Organization by bypassing the Organization's settings.
     * A break glass account is typically used for emergency purposes to gain access outside of normal authentication procedures.
     */
    is_breakglass: boolean;
    /**
     * Whether or not the Member has the `stytch_admin` Role. This Role is automatically granted to Members
     * who create an Organization through the discovery flow. See the
     * {@link https://stytch.com/docs/b2b/guides/rbac/stytch-default RBAC guide} for more details on this Role.
     */
    is_admin: boolean;
    /**
     * Returned if the member has a registered password
     */
    member_password_id: string;
    /**
     * If true, the member must complete a secondary authentication flow, such as SMS OTP, along with their
     * primary authentication factor in order to log in and attain a member session.
     */
    mfa_enrolled: boolean;
    /**
     * Returned if the member has a phone number.
     */
    mfa_phone_number: string;
    /**
     * Whether the member's phone number is verified.
     */
    mfa_phone_number_verified: boolean;
    /**
     * A list of the member's roles and their sources
     */
    roles: MemberRole[];
    /**
     * The member's default MFA method.
     */
    default_mfa_method: string;
    /**
     * Globally unique UUID that identifies a TOTP instance.
     */
    totp_registration_id: string;
    /**
     * A list of OAuth registrations for the member.
     */
    oauth_registrations: OAuthRegistration[];
    /**
     * The external ID of the member.
     */
    external_id?: string;
}
type B2BSessionTokens = {
    /**
     * An opaque session token.
     * Session tokens need to be authenticated via the {@link https://stytch.com/docs/b2b/api/authenticate-session SessionsAuthenticate}
     * endpoint before a member takes any action that requires authentication.
     * If the project is configured to use HttpOnly cookies, this field will always be empty.
     * See {@link https://stytch.com/docs/sessions#session-tokens-vs-JWTs_tokens our documentation} for more information.
     */
    session_token: string;
    /**
     * A JSON Web Token that contains standard claims about the user as well as information about the Stytch session
     * Session JWTs can be authenticated locally without an API call.
     * A session JWT is signed by project-specific keys stored by Stytch.
     * If the project is configured to use HttpOnly cookies, this field will always be empty.
     * See {@link https://stytch.com/docs/sessions#session-tokens-vs-JWTs_jwts our documentation} for more information.
     */
    session_jwt: string;
};
type B2BAuthenticateResponse<TProjectConfiguration extends StytchProjectConfigurationInput = Stytch.DefaultProjectConfiguration> = ResponseCommon & {
    /**
     * Globally unique UUID that identifies a specific member in the Stytch API.
     * The member_id critical to perform operations on a member in our API
     * so be sure to preserve this value.
     */
    member_id: string;
    /**
     * The Member Session object.
     * See {@link MemberSession} for details.
     */
    member_session: MemberSession;
    /**
     * The Member object.
     * See {@link Member} for details.
     */
    member: Member;
    /**
     * The Organization object.
     * See {@link Organization} for details.
     */
    organization: Organization;
} & IfOpaqueTokens<ExtractOpaqueTokens<TProjectConfiguration>, Redacted<B2BSessionTokens, RedactedToken>, B2BSessionTokens>;
type B2BAuthenticateResponseWithMFA<TProjectConfiguration extends StytchProjectConfigurationInput = Stytch.DefaultProjectConfiguration> = Omit<B2BAuthenticateResponse<TProjectConfiguration>, "member_session"> & ({
    /**
     * The Member Session object.
     * See {@link MemberSession} for details.
     */
    member_session: MemberSession;
    /**
     * Returns true if the member is fully authenticated, in which case a member session is returned.
     * Returns false if the member still needs to complete a secondary authentication requirement,
     * in which case an intermediate_session_token is returned.
     */
    member_authenticated: true;
    /**
     * The intermediate_session_token can be passed into a secondary authentication endpoint, such as OTP authenticate,
     * in order to receive a member session. The intermediate_session_token can also be used with discovery endpoints
     * to join a different organization or create a new organization.
     * If the project is configured to use HttpOnly cookies, this field will always be empty.
     */
    intermediate_session_token: "";
    /**
     * Contains information about the member's options for completing MFA, if applicable.
     */
    mfa_required: null;
    /**
     * Contains information about the member's requirements for verifying their email, if applicable.
     */
    primary_required: null;
} | {
    /**
     * The Member Session object.
     * See {@link MemberSession} for details.
     */
    member_session: null;
    /**
     * Returns true if the member is fully authenticated, in which case a member session is returned.
     * Returns false if the member still needs to complete a secondary authentication requirement,
     * in which case an intermediate_session_token is returned.
     */
    member_authenticated: false;
    /**
     * The intermediate_session_token can be passed into a secondary authentication endpoint, such as OTP authenticate,
     * in order to receive a member session. The intermediate_session_token can also be used with discovery endpoints
     * to join a different organization or create a new organization.
     * If the project is configured to use HttpOnly cookies, this field will always be empty.
     */
    intermediate_session_token: IfOpaqueTokens<ExtractOpaqueTokens<TProjectConfiguration>, RedactedToken, string>;
    /**
     * Contains information about the member's options for completing MFA, if applicable.
     */
    mfa_required: MfaRequired | null;
    /**
     * Contains information about the member's requirements for verifying their email, if applicable.
     */
    primary_required: PrimaryRequired | null;
});
type B2BAllowedAuthMethods = "sso" | "magic_link" | "password" | "google_oauth" | "microsoft_oauth" | "hubspot_oauth" | "slack_oauth" | "github_oauth" | "email_otp";
type B2BAllowedMFAMethods = "sms_otp" | "totp";
interface SSOActiveConnection {
    connection_id: string;
    display_name: string;
    identity_provider: string;
}
interface Organization {
    /**
     * Globally unique UUID that identifies an organization in the Stytch API.
     */
    organization_id: string;
    /**
     * The name of the organization.
     */
    organization_name: string;
    /**
     * The slug of the organization.
     */
    organization_slug: string;
    /**
     * The external ID of the organization.
     */
    organization_external_id?: string;
    /**
     * A URL of the organization's logo.
     */
    organization_logo_url: string;
    /**
     * A JSON object containing application-specific metadata.
     * This field can only be updated by a direct API integration.
     */
    trusted_metadata: Record<string, unknown>;
    /**
     * The organization's custom RBAC roles.
     * Custom roles are additive to the project's base RBAC policy.
     */
    custom_roles?: RBACPolicyRole[];
    /**
     * The default connection used for SSO when there are multiple active connections.
     */
    sso_default_connection_id: string | null;
    /**
     * The authentication setting that controls the JIT provisioning of Members when authenticating via SSO.
     * The accepted values are:
     *   ALL_ALLOWED – new Members will be automatically provisioned upon successful authentication via any of the Organization's sso_active_connections.
     *   RESTRICTED – only new Members with SSO logins that comply with sso_jit_provisioning_allowed_connections can be provisioned upon authentication.
     *   NOT_ALLOWED – disable JIT provisioning via SSO.
     */
    sso_jit_provisioning: "ALL_ALLOWED" | "RESTRICTED" | "NOT_ALLOWED";
    /**
     * An array of connection_ids that reference SAML Connection objects.
     * Only these connections will be allowed to JIT provision Members via SSO when sso_jit_provisioning is set to RESTRICTED.
     */
    sso_jit_provisioning_allowed_connections: string[];
    /**
     * An array of active SSO Connection references.
     */
    sso_active_connections: SSOActiveConnection[];
    /**
     * An active SCIM Connection reference.
     */
    scim_active_connection: {
        connection_id: string;
        display_name: string;
    } | null;
    /**
     * An array of email domains that allow invites or JIT provisioning for new Members.
     * This list is enforced when either email_invites or email_jit_provisioning is set to RESTRICTED.
     * Common domains such as gmail.com are not allowed.
     */
    email_allowed_domains: string[];
    /**
     * The authentication setting that controls how a new Member can be provisioned by authenticating via Email Magic Link.
     * The accepted values are:
     *   ALL_ALLOWED - any new Member can be provisioned via Email Magic Link.
     *   RESTRICTED – only new Members with verified emails that comply with email_allowed_domains can be provisioned upon authentication via Email Magic Link.
     *   NOT_ALLOWED – disable JIT provisioning via Email Magic Link.
     */
    email_jit_provisioning: "ALL_ALLOWED" | "RESTRICTED" | "NOT_ALLOWED";
    /**
     * The authentication setting that controls how a new Member can be invited to an organization by email.
     * The accepted values are:
     *   ALL_ALLOWED – any new Member can be invited to join via email.
     *   RESTRICTED – only new Members with verified emails that comply with email_allowed_domains can be invited via email.
     *   NOT_ALLOWED – disable email invites.
     */
    email_invites: "ALL_ALLOWED" | "RESTRICTED" | "NOT_ALLOWED";
    /**
     * The authentication setting that controls how a new Member can be provisioned by authenticating via OAuth, when the OAuth provider does not guarantee the validity of the email.
     * The accepted values are:
     *   RESTRICTED – only Members coming from an OAuth Tenant are in allowed_oauth_tenants are allowed to JIT provision.
     *   NOT_ALLOWED – disable JIT provisioning via OAuth.
     */
    oauth_tenant_jit_provisioning: "RESTRICTED" | "NOT_ALLOWED";
    /**
     * A JSON object of allowed OAuth Tenants to be used with oauth_tenant_jit_provisioning.
     * Records are provided with the provider, e.g. "hubspot", as the key, and a list of tenants, e.g. ['HubID1234', 'HubID2345'], as the value.
     */
    allowed_oauth_tenants: Record<string, string[]>;
    /**
     * The setting that controls which authentication methods can be used by Members of an Organization.
     * The accepted values are:
     *   ALL_ALLOWED – the default setting which allows all authentication methods to be used.
     *   RESTRICTED – only methods that comply with allowed_auth_methods can be used for authentication. This setting does not apply to Members with is_breakglass set to true.
     */
    auth_methods: "ALL_ALLOWED" | "RESTRICTED";
    /**
     * An array of allowed authentication methods.
     * This list is enforced when auth_methods is set to RESTRICTED.
     * The list's accepted values are: sso, magic_link, password, google_oauth, microsoft_oauth, hubspot_oauth, slack_oauth, github_oauth, and email_otp.
     */
    allowed_auth_methods?: B2BAllowedAuthMethods[];
    /**
     * The setting that controls which mfa methods can be used by Members of an Organization.
     * The accepted values are:
     *   ALL_ALLOWED – the default setting which allows all MFA methods to be used.
     *   RESTRICTED – only methods that comply with allowed_mfa_methods can be used for MFA. This setting does not apply to Members with is_breakglass set to true.
     */
    mfa_methods?: "ALL_ALLOWED" | "RESTRICTED";
    /**
     * An array of allowed MFA methods.
     * This list is enforced when mfa_methods is set to RESTRICTED.
     * The list's accepted values are: sms_otp and totp.
     */
    allowed_mfa_methods?: B2BAllowedMFAMethods[];
    /**
     * The setting that controls the MFA policy for all Members in the Organization. The accepted values are:
     *   REQUIRED_FOR_ALL – All Members within the Organization will be required to complete MFA every time they wish to log in.
     *   OPTIONAL – The default value. The Organization does not require MFA by default for all Members. Members will be required to complete MFA only if their mfa_enrolled status is set to true
     */
    mfa_policy: "OPTIONAL" | "REQUIRED_FOR_ALL";
    /**
     * An array of implicit role assignments granted to members in this organization whose emails match the domain.
     */
    rbac_email_implicit_role_assignments?: {
        role_id: string;
        domain: string;
    }[];
    /**
     * The setting that controls an Organization's policy towards allowing First Party Connected Apps to interact with its Members.
     * The accepted values are:
     *   ALL_ALLOWED - any Connected App in the Project may interact with the Organization's Members.
     *   RESTRICTED – only Connected Apps set in the allowlist (`allowed_first_party_connected_apps`) are permitted.
     *   NOT_ALLOWED – no Connected Apps are allowed.
     */
    first_party_connected_apps_allowed_type?: "ALL_ALLOWED" | "RESTRICTED" | "NOT_ALLOWED";
    /**
     * The IDs of First Party Connected Apps that are allowed to interact with an Organization's Members. This value is only
     * used if `first_party_connected_apps_allowed_type` is set to 'RESTRICTED'.
     */
    allowed_first_party_connected_apps?: string[];
    /**
     * The setting that controls an Organization's policy towards allowing Third Party Connected Apps to interact with its Members.
     * The accepted values are:
     *   ALL_ALLOWED - any Connected App in the Project may interact with the Organization's Members.
     *   RESTRICTED – only Connected Apps set in the allowlist (`allowed_first_party_connected_apps`) are permitted.
     *   NOT_ALLOWED – no Connected Apps are allowed.
     */
    third_party_connected_apps_allowed_type?: "ALL_ALLOWED" | "RESTRICTED" | "NOT_ALLOWED";
    /**
     * The IDs of Third Party Connected Apps that are allowed to interact with an Organization's Members. This value is only used
     * if `first_party_connected_apps_allowed_type` is set to 'RESTRICTED'.
     */
    allowed_third_party_connected_apps?: string[];
}
type B2BState = {
    member?: Member;
    organization?: Organization;
    session?: MemberSession;
};
interface DiscoveredOrganization {
    organization: Organization;
    membership: {
        type: "eligible_to_join_by_email_domain";
        details: {
            domain: string;
        };
        member: null;
    } | {
        type: "active_member" | "pending_member" | "invited_member";
        details: null;
        member: Member;
    } | {
        type: "eligible_to_join_by_oauth_tenant";
        details: {
            provider: string;
            tenant: string;
        };
        member: null;
    };
    member_authenticated: boolean;
    primary_required: PrimaryRequired | null;
    mfa_required: MfaRequired | null;
}
interface MfaRequired {
    member_options: MemberOptions | null;
    /**
     * Equal to 'sms_otp' if an OTP code was sent to the member's phone number.
     */
    secondary_auth_initiated: "sms_otp" | null;
}
interface PrimaryRequired {
    allowed_auth_methods: string[];
}
interface MemberOptions {
    mfa_phone_number: string;
}
type B2BDiscoveryAuthenticateResponse<TProjectConfiguration extends StytchProjectConfigurationInput = Stytch.DefaultProjectConfiguration> = ResponseCommon & {
    /**
     * The intermediate session token. This token does not belong to a specific instance of a member,
     * but may be exchanged for a member session or used to create a new organization.
     * If the project is configured to use HttpOnly cookies, this field will always be empty.
     */
    intermediate_session_token: IfOpaqueTokens<ExtractOpaqueTokens<TProjectConfiguration>, RedactedToken, string>;
    /**
     * The email of the end user who is logging in
     */
    email_address: string;
    discovered_organizations: DiscoveredOrganization[];
};
/**
 * The authentication methods we support through our UI.
 * Currently we support `emailMagicLinks`, `emailOtp`, `sso`, `passwords`, and `oauth`.
 */
declare enum B2BProducts {
    emailMagicLinks = "emailMagicLinks",
    emailOtp = "emailOtp",
    sso = "sso",
    passwords = "passwords",
    oauth = "oauth"
}
declare enum AuthFlowType {
    Discovery = "Discovery",
    Organization = "Organization",
    PasswordReset = "PasswordReset"
}
/**
 * The options for email magic links. This is used if you've enabled the `emailMagicLinks` product
 * in your configuration.
 */
type B2BEmailMagicLinksOptions = {
    loginRedirectURL?: string;
    signupRedirectURL?: string;
    discoveryRedirectURL?: string;
    loginTemplateId?: string;
    signupTemplateId?: string;
    /**
     * @param domainHint - An optional hint indicating what domain the email will be sent from.
     * This field is only required if your project uses more than one custom domain to send emails.
     */
    domainHint?: string;
    locale?: string;
};
/**
 * The options for SSO. This is used if you've enabled the `sso` product
 * in your configuration.
 */
type B2BSSOOptions = {
    loginRedirectURL?: string;
    signupRedirectURL?: string;
};
/**
 * The options for OAuth. This is required if you've enabled the `oauth` product
 * in your configuration.
 */
type B2BOAuthOptions = {
    loginRedirectURL?: string;
    signupRedirectURL?: string;
    discoveryRedirectURL?: string;
    /** @deprecated Use customScopes in B2BOAuthProviderConfig instead */
    customScopes?: string[];
    providers: B2BOAuthProviderConfig[];
    /** @deprecated Use providerParams in B2BOAuthProviderConfig instead */
    providerParams?: Record<string, string>;
    locale?: string;
};
/**
 * Details about the OAuth provider you wish to use. Each B2BOAuthProviderConfig object can be either a plain
 * B2BOAuthProviders string (e.g. 'google'), or  an object with a type key that determines the type of provider. For
 * Google OAuth, you can optionally specify the one_tap property to display Google One Tap.
 */
type B2BOAuthProviderConfig = EnumOrStringLiteral<B2BOAuthProviders> | {
    type: EnumOrStringLiteral<B2BOAuthProviders.Google>;
    one_tap: boolean;
    /**
     * Whether to cancel the One Tap prompt when the user taps outside of it.
     * This is only applicable if one_tap is true.
     */
    cancel_on_tap_outside?: boolean;
    customScopes?: string[];
    providerParams?: Record<string, string>;
} | {
    type: EnumOrStringLiteral<B2BOAuthProviders>;
    customScopes?: string[];
    providerParams?: Record<string, string>;
};
/**
 * The options for Passwords. This is used if you've enabled the `passwords` product
 * in your configuration.
 */
type B2BPasswordOptions = {
    loginRedirectURL?: string;
    resetPasswordRedirectURL?: string;
    resetPasswordExpirationMinutes?: number;
    resetPasswordTemplateId?: string;
    discoveryRedirectURL?: string;
    verifyEmailTemplateId?: string;
    locale?: string;
};
type B2BEmailOTPOptions = {
    loginTemplateId?: string;
    signupTemplateId?: string;
    locale?: string;
};
type B2BSMSOTPOptions = {
    locale?: string;
};
type DirectLoginForSingleMembershipConfig = {
    /**
     * Whether or not direct login for single membership is enabled.
     */
    status: boolean;
    /**
     * If enabled, logs user in directly even if they have pending invite to a different organization
     */
    ignoreInvites: boolean;
    /**
     * If enabled, logs user in directly even if they have organizations they could join via JIT provisioning
     */
    ignoreJitProvisioning: boolean;
};
type StytchB2BUIConfig = {
    /**
     * The products array allows you to specify the authentication methods that you would like to
     * expose to your users. The order of the products that you include here will also be the order
     * in which they appear in the login form,
     */
    products: EnumOrStringLiteral<B2BProducts>[];
    authFlowType: EnumOrStringLiteral<AuthFlowType>;
    sessionOptions: SessionOptions;
    emailMagicLinksOptions?: B2BEmailMagicLinksOptions;
    ssoOptions?: B2BSSOOptions;
    passwordOptions?: B2BPasswordOptions;
    oauthOptions?: B2BOAuthOptions;
    emailOtpOptions?: B2BEmailOTPOptions;
    smsOtpOptions?: B2BSMSOTPOptions;
    /**
     * An optional config that allows you to skip the discover flow and log a member
     * in directly only if they are a member of a single organization.
     */
    directLoginForSingleMembership?: DirectLoginForSingleMembershipConfig;
    /**
     * Whether or not an organization should be created directly when a user has
     * no memberships, invitations, or organizations they could join via JIT
     * provisioning. This has no effect if the ability to create organizations
     * from the frontend SDK is disabled in the Stytch dashboard. Defaults to
     * `false`.
     */
    directCreateOrganizationForNoMembership?: boolean;
    /**
     * Whether to prevent users who are not members of any organization from
     * creating a new organization during the discovery flow. This has no effect
     * if the ability to create organizations from the frontend SDK is disabled in
     * the Stytch dashboard. Defaults to `false`.
     */
    disableCreateOrganization?: boolean;
    /**
     * The order to present MFA products to a member when multiple choices are
     * available, such as during enrollment.
     */
    mfaProductOrder?: readonly EnumOrStringLiteral<B2BMFAProducts>[];
    /**
     * MFA products to include in the UI. If specified, the list of available
     * products will be limited to those included. Defaults to all available
     * products.
     *
     * Note that if an organization restricts the available MFA methods, the
     * organization's settings will take precedence. In addition, if a member is
     * enrolled in MFA compatible with their organization's policies, their
     * enrolled methods will always be made available.
     */
    mfaProductInclude?: readonly EnumOrStringLiteral<B2BMFAProducts>[];
    /**
     * The slug of the organization to use in the organization-specific auth flow.
     * If not specified, the organization will be inferred from the URL based on
     * the project's configured slug pattern.
     *
     * This has no effect outside of the organization-specific auth flow.
     */
    organizationSlug?: string | null;
};
declare enum B2BMFAProducts {
    smsOtp = "smsOtp",
    totp = "totp"
}
/**
 * The OAuth providers we support in our B2B OAuth product.
 */
declare enum B2BOAuthProviders {
    Google = "google",
    Microsoft = "microsoft",
    HubSpot = "hubspot",
    Slack = "slack",
    GitHub = "github"
}
/**
 * An Error class representing an error within Stytch.
 */
declare class StytchError extends Error {
    constructor(name: string, message: string);
}
type StytchSDKErrorOptions = {
    url?: string;
};
/**
 * An Error class used in the Stytch SDK.
 */
declare class StytchSDKError extends StytchError {
    options?: StytchSDKErrorOptions;
    constructor(name: string, description: string, options?: StytchSDKErrorOptions);
}
/**
 * The authentication methods we support through our UI.
 * Currently we support `emailMagicLinks`, `oauth`, `otp`, `crypto` and `passwords`.
 */
declare enum Products {
    emailMagicLinks = "emailMagicLinks",
    oauth = "oauth",
    otp = "otp",
    crypto = "crypto",
    passwords = "passwords",
    passkeys = "passkeys"
}
/**
 * The options for email magic links. This is used if you've enabled the `emailMagicLinks` product
 * in your configuration.
 */
type EmailMagicLinksOptions = {
    loginRedirectURL?: string;
    loginExpirationMinutes?: number;
    signupRedirectURL?: string;
    signupExpirationMinutes?: number;
    loginTemplateId?: string;
    signupTemplateId?: string;
    createUserAsPending?: boolean;
    /**
     * @param domainHint - An optional hint indicating what domain the email will be sent from.
     * This field is only required if your project uses more than one custom domain to send emails.
     */
    domainHint?: string;
    locale?: string;
};
/**
 * The OAuth providers we support in our OAuth product.
 * Currently we support `Amazon`, `Apple`, `Bitbucket`, `Discord`, `Facebook`, `Figma`, `Google`, `GitLab`,
 * `LinkedIn`, `Microsoft`, `Salesforce`, `Slack`, `Snapchat`, `TikTok`, `Twitch`, `Twitter`, and `Yahoo`.
 */
declare enum OAuthProviders {
    Google = "google",
    Microsoft = "microsoft",
    Apple = "apple",
    Github = "github",
    GitLab = "gitlab",
    Facebook = "facebook",
    Discord = "discord",
    Salesforce = "salesforce",
    Slack = "slack",
    Amazon = "amazon",
    Bitbucket = "bitbucket",
    LinkedIn = "linkedin",
    Coinbase = "coinbase",
    Twitch = "twitch",
    Twitter = "twitter",
    TikTok = "tiktok",
    Snapchat = "snapchat",
    Figma = "figma",
    Yahoo = "yahoo"
}
/**
 * Supported behaviors for positioning Google One Tap. The actual behavior
 * depends on browser support and Google's One Tap implementation.
 */
declare enum OneTapPositions {
    /**
     * Display Google One Tap using a native browser prompt if available, or
     * embedded in the existing SDK login form otherwise.
     * @deprecated This option has been renamed to `floatingOrEmbedded`
     */
    embedded = "embedded",
    /**
     * Display the One Tap prompt using a native browser prompt if available, or
     * in the top right corner otherwise. This is the default option.
     */
    floating = "floating",
    /**
     * Display the One Tap prompt embedded in the existing SDK login form if a
     * native browser prompt is not available, or not at all otherwise. This
     * option is not recommended for new applications.
     */
    embeddedOnly = "embeddedOnly",
    /**
     * Display the One Tap prompt using a native browser prompt if available, or
     * embedded in the existing SDK login form otherwise.
     */
    floatingOrEmbedded = "floatingOrEmbedded",
    /**
     * Attempt to display the One Tap prompt embedded in the existing SDK login
     * form, even if a native browser prompt is supported. This option is not
     * recommended. It disables native browser FedCM support even where it is
     * available, and will stop being honored by Google in the future.
     */
    forceLegacyEmbedded = "forceLegacyEmbedded"
}
type ProviderOptions = {
    type: EnumOrStringLiteral<OAuthProviders>;
    one_tap?: boolean;
    position?: EnumOrStringLiteral<OneTapPositions>;
    /**
     * Whether to cancel the One Tap prompt when the user taps outside of it.
     * This is only applicable if one_tap is true.
     */
    cancel_on_tap_outside?: boolean;
    custom_scopes?: string[];
    provider_params?: Record<string, string>;
};
/**
 * An array of OAuth providers you wish to use. Each Provider is an object with a type key that
 * determines the type of provider. Each Provider accepts an optional custom_scopes array of
 * scopes that Stytch will request for your application in addition to the base set of scopes
 * required for login. The order of the providers in the array determines the order of the
 * rendered buttons.
 */
type ProvidersOptions = ProviderOptions[];
/**
 * The options for oAuth. This is required if you've enabled the `oauth` product
 * in your configuration.
 */
type OAuthOptions = {
    loginRedirectURL?: string;
    signupRedirectURL?: string;
    providers: ProvidersOptions;
};
/**
 * The methods array allows you to specify the authentication methods that you would like to expose
 * to your users. The order of the products that you include here will also be the order in which
 * they appear in the login form, with the first product specified appearing at the top of the login
 * form. We currently support passcodes on `email`, `sms` and `whatsapp`
 */
declare enum OTPMethods {
    SMS = "sms",
    WhatsApp = "whatsapp",
    Email = "email"
}
/**
 * The options for One Time Passcodes. This is required if you've enabled the `otp` product
 * in your configuration.
 */
type OtpOptions = {
    methods: EnumOrStringLiteral<OTPMethods>[];
    expirationMinutes: number;
    loginTemplateId?: string;
    signupTemplateId?: string;
    locale?: string;
};
/**
 * The options for passwords. This is used if you've enabled the `passwords` product
 * in your configuration.
 */
type PasswordOptions = {
    loginRedirectURL?: string;
    loginExpirationMinutes?: number;
    resetPasswordRedirectURL?: string;
    resetPasswordExpirationMinutes?: number;
    resetPasswordTemplateId?: string;
    locale?: string;
};
/**
 * The options for Session Management. If you are using the UI components,
 * we also create a session for users when they log in.
 */
type SessionOptions = {
    sessionDurationMinutes: number;
};
type PasskeyOptions = {
    /**
     * Sets the domain option for both webauthn registration and authentication.
     * @default window.location.hostname
     */
    domain?: string;
};
/**
 * The configuration object for the Stytch SDK's UI
 */
type StytchLoginConfig = {
    /**
     * The products array allows you to specify the authentication methods that you would like to
     * expose to your users. The order of the products that you include here will also be the order
     * in which they appear in the login form,
     */
    products: EnumOrStringLiteral<Products>[];
    emailMagicLinksOptions?: EmailMagicLinksOptions;
    oauthOptions?: OAuthOptions;
    otpOptions?: OtpOptions;
    sessionOptions?: SessionOptions;
    passwordOptions?: PasswordOptions;
    passkeyOptions?: PasskeyOptions;
    /**
     * The `enableShadowDOM` configuration option allows developers to use the Stytch SDK in a shadow DOM. This defaults to `false`.
     */
    enableShadowDOM?: boolean;
};
declare enum RNUIProducts {
    emailMagicLinks = 0,
    oauth = 1,
    otp = 2,
    passwords = 3
}
type RNUIEmailMagicLinksOptions = {
    loginExpirationMinutes?: number;
    signupExpirationMinutes?: number;
    loginTemplateId?: string;
    signupTemplateId?: string;
    locale?: string;
};
type RNUIOAuthOptions = {
    providers: EnumOrStringLiteral<OAuthProviders>[] | ProvidersOptions;
    /** @deprecated Use custom_scopes in ProvidersOptions instead */
    customScopes?: string[];
    /** @deprecated Use provider_params in ProvidersOptions instead */
    providerParams?: Record<string, string>;
};
type RNUIOTPOptions = {
    methods: EnumOrStringLiteral<OTPMethods>[];
    expirationMinutes: number;
    loginTemplateId?: string;
    signupTemplateId?: string;
    locale?: string;
};
type RNUIPasswordOptions = {
    loginExpirationMinutes?: number;
    resetPasswordExpirationMinutes?: number;
    resetPasswordTemplateId?: string;
    locale?: string;
};
type RNUIProductConfig = {
    products: RNUIProducts[];
    emailMagicLinksOptions: RNUIEmailMagicLinksOptions;
    oAuthOptions: RNUIOAuthOptions;
    otpOptions: RNUIOTPOptions;
    sessionOptions: SessionOptions;
    passwordOptions: RNUIPasswordOptions;
};
type TokenType = "magic_links" | "oauth" | "reset_password";
declare enum EmailSentType {
    LoginOrCreateEML = "login_or_create_eml",
    LoginOrCreateOTP = "login_or_create_otp",
    ResetPassword = "reset_password"
}
type AnalyticsEvent = {
    name: "sdk_instance_instantiated";
    details: {
        event_callback_registered: boolean;
        error_callback_registered: boolean;
        success_callback_registered: boolean;
    };
} | {
    name: "b2b_sdk_instance_instantiated";
    details: {
        event_callback_registered: boolean;
        error_callback_registered: boolean;
        success_callback_registered: boolean;
    };
} | {
    name: "render_login_screen";
    details: {
        options: StytchLoginConfig | RNUIProductConfig;
        bootstrap: BootstrapData;
    };
} | {
    name: "render_b2b_login_screen";
    details: {
        options: StytchB2BUIConfig;
        bootstrap: BootstrapData;
    };
} | {
    name: "render_idp_screen";
    details: {
        bootstrap: BootstrapData;
    };
} | {
    name: "render_b2b_idp_screen";
    details: {
        bootstrap: BootstrapData;
    };
} | {
    name: "email_sent";
    details: {
        email: string;
        type: EmailSentType;
    };
} | {
    name: "email_try_again_clicked";
    details: {
        email: string;
        type: EmailSentType;
    };
} | {
    name: "start_oauth_flow";
    details: {
        provider_type: string;
        custom_scopes?: string[];
        cname_domain: string | null;
        pkce: boolean;
        provider_params?: Record<string, string>;
    };
} | {
    name: "deeplink_handled_success";
    details: {
        token_type: TokenType;
    };
} | {
    name: "deeplink_handled_failure";
    details: {
        error: StytchSDKError | undefined;
    };
} | {
    name: "oauth_success";
    details: {
        provider_type: string;
    };
} | {
    name: "oauth_failure";
    details: {
        error: StytchSDKError | string | undefined;
    };
} | {
    name: "ui_authentication_success";
    details: {
        method: "oauth" | "otp" | "magicLinks" | "passwords";
    };
} | {
    name: "render_b2b_admin_portal_sso";
    details: Record<string, never>;
} | {
    name: "render_b2b_admin_portal_org_settings";
    details: Record<string, never>;
} | {
    name: "render_b2b_admin_portal_member_management";
    details: Record<string, never>;
} | {
    name: "render_b2b_admin_portal_scim";
    details: Record<string, never>;
};
type SDKRequestMethodAndBody = {
    method: "GET" | "DELETE";
    body?: null;
} | {
    method: "POST" | "PUT";
    body?: Record<string, unknown>;
};
type SDKRequestInfo = SDKRequestMethodAndBody & {
    url: string;
    additionalMetadata?: Record<string, string>;
};
interface SDKTelemetry {
    event_id: string;
    app_session_id: string;
    persistent_id: string;
    client_sent_at: string;
    timezone: string;
    // Logged in user data
    // Why don't we generate this from the session_token in the auth header?
    // - We don't want to tie analytics ingest to session validation. There's no need to put
    //   that kind of pressure on API, and ingest could be moved to somewhere that doesn't
    //   have the ability to validate tokens
    // - For bulk event batches, we want to keep track of whether or not a user was logged
    //   in at each event. If we have 10 events, the user logs in at event 5, then they'll have
    //   a token when they log the batch, but we want to know that they were not logged in for the
    //   first 4 events
    // Versioning
    app: {
        identifier: string;
        version?: string;
    };
    os?: {
        identifier?: string;
        version?: string;
    };
    device?: {
        model?: string;
        screen_size?: string;
    };
    sdk: {
        identifier: string;
        version: string;
    };
}
interface INetworkClient {
    createTelemetryBlob(additionalMetadata?: SDKRequestInfo["additionalMetadata"]): SDKTelemetry;
    fetchSDK: <T extends ResponseCommon>(info: SDKRequestInfo) => Promise<T>;
    retriableFetchSDK: <T extends ResponseCommon>(info: RetriableSDKRequestInfo) => Promise<T>;
    logEvent<E extends AnalyticsEvent>({ name, details, error }: {
        name: E["name"];
        details: E["details"];
        error?: {
            error_code?: string;
            error_description?: string;
            http_status_code?: string;
        };
    }): void;
    // @deprecated Use the new sessions.updateSession() method instead
    updateSessionToken: (sessionToken: string | null) => void;
}
type RetriableSDKRequestInfo = SDKRequestInfo & {
    retryCallback: (e: RetriableError, info: SDKBaseRequestInfo) => Promise<SDKBaseRequestInfo>;
};
declare enum RetriableErrorType {
    RequiredCaptcha = "CAPTCHA required"
}
declare class RetriableError extends Error {
    type: RetriableErrorType;
    constructor(type: RetriableErrorType);
}
type SDKBaseRequestInfo = {
    basicAuthHeader: string;
    xSDKClientHeader: string;
    xSDKParentHostHeader?: string;
    body: SDKRequestInfo["body"];
    method: SDKRequestInfo["method"];
    finalURL: string;
};
type ProofkeyPair = {
    code_challenge: string;
    code_verifier: string;
};
interface IPKCEManager {
    startPKCETransaction(): Promise<ProofkeyPair>;
    getPKPair(): AsyncGetPKPair | SyncGetPKPair;
    clearPKPair(): Promise<void> | void;
}
type AsyncGetPKPair = Promise<ProofkeyPair | undefined>;
type SyncGetPKPair = ProofkeyPair | undefined;
interface ISyncPKCEManager extends IPKCEManager {
    startPKCETransaction(): Promise<ProofkeyPair>;
    getPKPair(): SyncGetPKPair;
    clearPKPair(): void;
}
type SubscriberFunction<T> = (value: T | null) => void;
type StateWithReadableTokensLoggedIn<TState> = {
    state: TState | null;
    intermediate_session_token: null;
    session_token: string;
    session_jwt: string;
};
type StateWithOpaqueTokensLoggedIn<TState> = {
    state: TState | null;
    intermediate_session_token: null;
    session_token: true;
    session_jwt: true;
};
type StateWithTokensLoggedIn<TState, TOpaqueTokens extends AllowedOpaqueTokens> = IfOpaqueTokens<TOpaqueTokens, StateWithOpaqueTokensLoggedIn<TState>, StateWithReadableTokensLoggedIn<TState>>;
type StateWithTokensLoggedOut = {
    state: null;
    session_token: null;
    session_jwt: null;
    intermediate_session_token: null;
};
type StateWithReadableIntermediateSessionToken = {
    state: null;
    session_token: null;
    session_jwt: null;
    intermediate_session_token: string;
};
type StateWithOpaqueIntermediateSessionToken = {
    state: null;
    session_token: null;
    session_jwt: null;
    intermediate_session_token: true;
};
type StateWithIntermediateSessionToken<TOpaqueTokens extends AllowedOpaqueTokens> = IfOpaqueTokens<TOpaqueTokens, StateWithOpaqueIntermediateSessionToken, StateWithReadableIntermediateSessionToken>;
type StateWithTokensDiff<TState, TOpaqueTokens extends AllowedOpaqueTokens> = StateWithTokensLoggedIn<TState, TOpaqueTokens> | StateWithTokensLoggedOut | StateWithIntermediateSessionToken<TOpaqueTokens>;
interface CommonAuthenticateOptions {
    session_duration_minutes?: number;
    // Needed so TS does not complain about "no properties in common" error
    [key: string]: unknown;
}
interface ISubscriptionService<TState, TOpaqueTokens extends AllowedOpaqueTokens> {
    updateStateAndTokens(diff: StateWithTokensDiff<TState, TOpaqueTokens>): void;
    updateState(state: TState): void;
    updateTokens(tokens: SessionTokensUpdate): void;
    destroyState(): void;
    destroySession(): void;
    getTokens(): IfOpaqueTokens<TOpaqueTokens, never, SessionTokens$0 | null>;
    getIntermediateSessionToken(): string | null;
    subscribeToState(callback: SubscriberFunction<(TState & SessionUpdateOptions) | null>): UnsubscribeFunction;
    getState(): TState | null;
    syncFromDeviceStorage(onCompleteCallback: () => void): void;
    getFromCache(): boolean;
    setCacheRefreshed(): void;
}
interface IConsumerSubscriptionService<TProjectConfiguration extends StytchProjectConfigurationInput> extends ISubscriptionService<ConsumerState, AllowedOpaqueTokens> {
    updateSession(args: AuthenticateResponse<TProjectConfiguration>, options?: SessionUpdateOptions): void;
    /**
     * Decorator version of updateSession that wraps an existing authenticate() implementation to bind its response
     * to subscriptionService.updateSession().
     */
    withUpdateSession<
    // These are a bit messy to be able to type all authenticate() implementations
    Args extends [
    ] | [
        options?: CommonAuthenticateOptions
    ] | (string | CommonAuthenticateOptions)[], Ret extends AuthenticateResponse<TProjectConfiguration> | null>(authenticate: (...args: Args) => Promise<Ret>): (...args: Args) => Promise<Ret>;
    updateUser(user: User): void;
    getUser(): User | null;
    getSession(): Session | null;
}
interface IB2BSubscriptionService<TProjectConfiguration extends StytchProjectConfigurationInput> extends ISubscriptionService<B2BState, AllowedOpaqueTokens> {
    updateSession(args: B2BAuthenticateResponse<TProjectConfiguration> | B2BAuthenticateResponseWithMFA<TProjectConfiguration> | B2BDiscoveryAuthenticateResponse<TProjectConfiguration>, options?: SessionUpdateOptions): void;
    /**
     * Decorator version of updateSession that wraps an existing authenticate() implementation to bind its response
     * to subscriptionService.updateSession()
     */
    withUpdateSession<Options extends CommonAuthenticateOptions | undefined, Ret extends B2BAuthenticateResponse<TProjectConfiguration> | B2BAuthenticateResponseWithMFA<TProjectConfiguration> | B2BDiscoveryAuthenticateResponse<TProjectConfiguration>>(authenticate: (options: Options) => Promise<Ret>): (options: Options) => Promise<Ret>;
    updateMember(member: Member): void;
    getMember(): Member | null;
    updateOrganization(organization: Organization): void;
    getOrganization(): Organization | null;
    getSession(): MemberSession | null;
}
declare class MockDFPProtectedAuth {
    private state;
    constructor(enabled: boolean, mockTelemetryID: string | undefined, executeRecaptcha?: () => Promise<string | undefined>);
    isEnabled: () => Promise<boolean>;
    getTelemetryID: () => Promise<string | undefined>;
    getDFPTelemetryIDAndCaptcha: () => Promise<{
        dfp_telemetry_id?: string | undefined;
        captcha_token?: string | undefined;
    }>;
    executeRecaptcha: () => Promise<string | undefined>;
    retryWithCaptchaAndDFP: (e: RetriableError, req: SDKBaseRequestInfo) => Promise<SDKBaseRequestInfo>;
}
declare const MockDFPProtectedAuthDisabled: () => MockDFPProtectedAuth;
declare const MockDFPProtectedAuthCaptchaOnly: () => MockDFPProtectedAuth;
declare const MockDFPProtectedAuthDFPAndCaptcha: () => MockDFPProtectedAuth;
declare const MockDFPProtectedAuthDFPOnly: () => MockDFPProtectedAuth;
declare class MockPKCEManager implements ISyncPKCEManager {
    private pair;
    constructor();
    setPKPair(pair: ProofkeyPair): void;
    clearPKPair(): void;
    getPKPair(): ProofkeyPair | undefined;
    startPKCETransaction(): Promise<ProofkeyPair>;
}
type INetworkClientMock = {
    [k in keyof INetworkClient]: jest.Mock;
};
type IConsumerSubscriptionServiceMock = {
    [k in keyof IConsumerSubscriptionService<StytchProjectConfigurationInput>]: jest.Mock;
};
type IB2BSubscriptionServiceMock = {
    [k in keyof IB2BSubscriptionService<StytchProjectConfigurationInput>]: jest.Mock;
};
declare const createTestFixtures: () => {
    networkClient: INetworkClientMock;
    apiNetworkClient: INetworkClientMock;
    subscriptionService: IConsumerSubscriptionServiceMock;
    pkceManager: MockPKCEManager;
    secondPKCEManager: MockPKCEManager;
    captchaProvider: () => Promise<string>;
    dfpProtectedAuth: MockDFPProtectedAuth;
};
declare const createB2BTestFixtures: () => {
    networkClient: INetworkClientMock;
    apiNetworkClient: INetworkClientMock;
    subscriptionService: IB2BSubscriptionServiceMock;
    pkceManager: MockPKCEManager;
    secondPKCEManager: MockPKCEManager;
    captchaProvider: () => Promise<string>;
};
declare const createResolvablePromise: <T = void>() => {
    promise: Promise<T>;
    resolve: (value: T) => void;
    reject: (error?: unknown) => void;
};
declare function getMockStorageClient(): {
    getData: jest.Mock<any, any, any>;
    setData: jest.Mock<any, any, any>;
    clearData: jest.Mock<any, any, any>;
};
declare const PUBLIC_TOKEN = "public-token-test-1234";
export { MockDFPProtectedAuth, MockDFPProtectedAuthDisabled, MockDFPProtectedAuthCaptchaOnly, MockDFPProtectedAuthDFPAndCaptcha, MockDFPProtectedAuthDFPOnly, MockPKCEManager, INetworkClientMock, IConsumerSubscriptionServiceMock, IB2BSubscriptionServiceMock, createTestFixtures, createB2BTestFixtures, createResolvablePromise, getMockStorageClient, PUBLIC_TOKEN };