import type { EidRedirectResult } from "./eid.types";
/**
 * Opens the Trinsic `launchUrl` in a popup window.
 *
 * When Trinsic completes authentication it redirects back to
 * `eid.verification.trulioo.com/auth/callback`, which signals the SDK via two paths:
 *
 * **Path 1 — postMessage (cross-origin capable):**
 * The callback page calls `window.opener.postMessage(...)`. This requires `window.opener`
 * to be set, which is only available when `noopener` is NOT in the window.open feature
 * string. Origin + source + nonce validation prevents spoofing.
 *
 * **Path 2 — BroadcastChannel (same-origin, real-time):**
 * When `channelKey` is provided the server embeds `?ckey=<channelKey>` in the redirect URL.
 * The callback page opens `BroadcastChannel("eid_callback_<channelKey>")` and broadcasts the
 * Trinsic result. This path resolves as soon as the message arrives, racing postMessage.
 * BroadcastChannel is origin-scoped — only works when the SDK host app and the callback page
 * share the same origin (e.g. Trulioo-hosted demo apps).
 *
 * ## Security hardening
 * - postMessage: validates `event.origin`, `event.source === popup`, message type, and nonce.
 * - BroadcastChannel: nonce validated against the payload when present.
 * - Grace period after `popup.closed` before declaring cancelled
 *   (postMessage / BroadcastChannel message may still be in-flight).
 *
 * @param url Trinsic-issued `launchUrl` from services-apps.
 * @param nonce Optional CSRF nonce embedded in the URL and echoed back in the postMessage.
 * @param callbackOrigin Origin of the hosted callback page. Defaults to `verification.trulioo.com`.
 * @param channelKey Optional UUID generated at prepare() time. When provided, a BroadcastChannel
 *   listener races alongside the postMessage listener.
 * @param timeoutMs Optional maximum wait time in milliseconds. When provided, resolves
 *   `{ type: "timeout" }` if neither postMessage nor BroadcastChannel delivers a result within
 *   the given window. Required for the noopener path where popup is null and closed-detection
 *   is unavailable.
 */
export declare function launchPopup(url: string, nonce?: string, callbackOrigin?: string, channelKey?: string, timeoutMs?: number): Promise<EidRedirectResult>;