export declare const ACCOUNT_LIMIT_MESSAGE = "This device already remembers 5 accounts, the maximum, so another cannot be added. Remembered accounts persist until they are signed out, so sign out of one to free a slot \u2014 call signOut() (or removeAccount()) when a user leaves.";
export declare const signUpWithEmailAndPasswordThunk: import("@reduxjs/toolkit").AsyncThunk<any, {
    projectId: string;
    email: string;
    password: string;
    name?: string;
    username?: string;
    avatar?: string;
    bio?: string;
    location?: {
        latitude: number;
        longitude: number;
    };
    birthdate?: Date;
    metadata?: Record<string, any>;
    secureMetadata?: Record<string, any>;
    avatarFile?: File | Blob;
    avatarOptions?: any;
    bannerFile?: File | Blob;
    bannerOptions?: any;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
export declare const signInWithEmailAndPasswordThunk: import("@reduxjs/toolkit").AsyncThunk<any, {
    projectId: string;
    email: string;
    password: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
export declare const signOutThunk: import("@reduxjs/toolkit").AsyncThunk<undefined, {
    projectId: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
export declare const confirmAccountDeletionThunk: import("@reduxjs/toolkit").AsyncThunk<undefined, {
    projectId: string;
    code: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
/**
 * Why a stored credential could not be exchanged for a live session.
 *
 * Carried as the rejected action's `meta` rather than folded into the payload,
 * which stays the plain string every existing consumer reads
 * (`useAuth().requestNewAccessToken`, `useAuthGate`, `initializeAuthThunk` and
 * any integrator branching on `rejected.match(...)`).
 *
 * ONE bit, and it is the one the launch path turns on: did the SERVER refuse
 * this credential, or did the request never reach it? Without it the init catch
 * fires on any error at all, so a single offline launch tore the session down
 * and persisted a deliberate sign-out — which contradicts the transition core's
 * own stated rule that a transport failure is not a dead account.
 */
export interface RefreshRejectionMeta {
    /**
     * True when the server refused the credential (401/403 — expired, revoked,
     * reuse-detected, invalidated by a password change or a remote sign-out-all),
     * and when there was no credential to present at all. False for a transport
     * failure, which says nothing about whether the account is alive.
     */
    credentialRejected: boolean;
}
export declare const requestNewAccessTokenThunk: import("@reduxjs/toolkit").AsyncThunk<string, {
    projectId: string;
}, {
    rejectValue: string;
    rejectedMeta: RefreshRejectionMeta;
    extra?: unknown;
    dispatch?: import("@reduxjs/toolkit").ThunkDispatch<unknown, unknown, import("@reduxjs/toolkit").UnknownAction> | undefined;
    state?: unknown;
    serializedErrorType?: unknown;
    pendingMeta?: unknown;
    fulfilledMeta?: unknown;
}>;
export declare const verifyExternalUserThunk: import("@reduxjs/toolkit").AsyncThunk<any, {
    projectId: string;
    userJwt: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
/**
 * The OAuth tail: fetch the profile for the tokens the redirect carried, then
 * apply Gate 2 to the identity that comes back.
 *
 * **The fourth entry point, and the one most easily missed.** OAuth never goes
 * through the sign-in thunks: `oauthCore`'s `handleOAuthRedirect` drives
 * `setTokens` → `setInitialized` → the refresh itself. A cap guard placed only
 * on the sign-in thunks would leave the single path that also has no pre-flight
 * completely uncovered, which is the exact shape that corrupted the map.
 *
 * **It does not reject its caller, by design.** `handleOAuthRedirect` is
 * synchronous, shared by `@sublay/react-js` and `@sublay/expo`, and returns
 * `{ success: true }` before any identity exists; on web the flow is a full-page
 * navigation, so the promise from `initiateOAuth` belongs to a document that no
 * longer exists by the time the callback runs. Making either platform reject
 * would mean making that exported function async and changing the Expo hook's
 * error convention from state to throw. Decided: don't. **Both OAuth paths
 * surface the cap through `accountLimitReached`** — that is why the flag exists
 * alongside the thrown errors, and the asymmetry is documented.
 *
 * This is also the one Gate-2 site that must UNWIND rather than run first: the
 * tokens were written before the identity was knowable.
 */
export declare const completeOAuthSignInThunk: import("@reduxjs/toolkit").AsyncThunk<void, {
    projectId: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
export declare const changePasswordThunk: import("@reduxjs/toolkit").AsyncThunk<undefined, {
    projectId: string;
    password: string;
    newPassword: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
export declare const setPasswordThunk: import("@reduxjs/toolkit").AsyncThunk<undefined, {
    projectId: string;
    newPassword: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
export declare const signOutAllThunk: import("@reduxjs/toolkit").AsyncThunk<undefined, {
    projectId: string;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;
export declare const initializeAuthThunk: import("@reduxjs/toolkit").AsyncThunk<void, {
    projectId: string;
    signedToken?: string | null;
}, import("@reduxjs/toolkit").AsyncThunkConfig>;