import { ReactNode } from 'react';
import { Subject } from '@voltro/protocol';

/** True when this browser can do WebAuthn at all. */
export declare const isPasskeySupported: () => boolean;

export declare interface PasskeyClientOptions {
    /** Base path the auth routes are mounted under. Default `/auth`. */
    readonly basePath?: string;
    /** Pass the CSRF token (from the `voltro:csrf` cookie / `GET /auth/csrf`)
     *  so registration (an authenticated, state-changing flow) passes the
     *  double-submit check. */
    readonly csrfToken?: string;
    /** `fetch` override (tests / custom credentials mode). Defaults to the
     *  global `fetch` with `credentials: 'include'`. */
    readonly fetchImpl?: typeof fetch;
}

declare interface ProviderProps {
    /** Subject decoded from the session cookie, or null when unsigned. */
    readonly subject: Subject | null;
    readonly children: ReactNode;
}

/**
 * Register a passkey for the (signed-in) user. Runs both ceremony steps:
 * fetch creation options, call `navigator.credentials.create`, post the
 * result for verification. Resolves to the new credential id.
 */
export declare const registerPasskey: (input: {
    userId: string;
    userName: string;
}, options?: PasskeyClientOptions) => Promise<{
    credentialId: string;
}>;

export declare const RequireAuth: ({ children, fallback }: RequireAuthProps) => ReactNode;

declare interface RequireAuthProps {
    readonly children: ReactNode | ((subject: Subject) => ReactNode);
    /** Rendered when no Subject is present. Typically <LoginCard />. */
    readonly fallback: ReactNode;
}

/**
 * Sign in with a passkey. Fetches assertion options, calls
 * `navigator.credentials.get`, posts the assertion for verification.
 * Resolves to the resolved subject on success.
 */
export declare const signInWithPasskey: (input?: {
    userId?: string;
}, options?: PasskeyClientOptions) => Promise<{
    subject: unknown;
}>;

export declare const SubjectProvider: ({ subject, children }: ProviderProps) => ReactNode;

/** Read the Subject; returns null when no session is present. */
export declare const useOptionalSubject: () => Subject | null;

/**
 * Read the resolved Subject. THROWS when not signed in — pair with
 * `<RequireAuth>` or with a route-level guard so the throw can't
 * surface to end users. Use `useOptionalSubject()` when both states
 * are valid in the same component.
 */
export declare const useSubject: () => Subject;

export { }