/** Pure URL helpers shared by the Expo auth client and its tests. */
declare function buildExpoOAuthStartUrl(baseUrl: string, provider: string, redirectUri: string, state?: string, startPath?: string, codeChallenge?: string): string;
declare function codeFromExpoRedirect(url: string): string | null;
declare function stateFromExpoRedirect(url: string): string | null;
declare function normalizeExpoBaseUrl(baseUrl: string): string;

/** The Expo client's errors, without its native dependencies, so the web build of deepspace/native can share them. */
declare class DeepSpaceExpoError extends Error {
    readonly status: number;
    readonly body: unknown;
    constructor(message: string, status: number, body: unknown);
}
/**
 * Thrown by `signIn` when the person closes the sign-in sheet. It isn't a
 * failure, so apps usually return to where they were without showing an error.
 * Check `code`: `instanceof` fails if the bundler includes two copies of
 * this package.
 */
declare class DeepSpaceSignInCancelledError extends Error {
    readonly code: "sign_in_cancelled";
    constructor();
}

type ExpoAuthProvider = 'google' | (string & {});
interface DeepSpaceExpoSession {
    sessionToken: string;
    accessToken: string;
}
interface DeepSpaceExpoUser {
    userId: string;
    claims: Record<string, unknown>;
}
interface ExpoAuthStorage {
    getItem(key: string): Promise<string | null>;
    setItem(key: string, value: string): Promise<void>;
    deleteItem(key: string): Promise<void>;
}
interface DeepSpaceExpoClientOptions {
    /** Deployed app origin, for example `https://example.app.space`. */
    baseUrl: string;
    /** Defaults to Expo's `createURL('auth/callback')`. */
    redirectUri?: string;
    /** SecureStore-backed by default; inject a test store when unit testing. */
    storage?: ExpoAuthStorage;
    /** Namespaced storage key so multiple apps can share one device. */
    storageKey?: string;
    /** Worker endpoint overrides for apps with a custom auth route. */
    paths?: Partial<ExpoAuthPaths>;
    fetch?: typeof globalThis.fetch;
    /** Abort stalled auth/API requests after this many milliseconds. */
    timeoutMs?: number;
}
interface ExpoAuthPaths {
    start: string;
    exchange: string;
    token: string;
    me: string;
    signOut: string;
}
/** Called with the new session after sign-in or refresh, and with `null` after sign-out or expiry. */
type DeepSpaceExpoSessionListener = (session: DeepSpaceExpoSession | null) => void;

declare function createDeepSpaceExpoClient(options: DeepSpaceExpoClientOptions): DeepSpaceExpoClient;
declare class DeepSpaceExpoClient {
    private readonly baseUrl;
    private readonly redirectUri;
    private readonly storage;
    private readonly storageKey;
    private readonly paths;
    private readonly fetcher;
    private readonly timeoutMs;
    private session;
    private refreshing;
    private sessionGeneration;
    private authOperationGeneration;
    private storageWrites;
    private readonly listeners;
    constructor(options: DeepSpaceExpoClientOptions);
    /** The deployed app origin this client talks to, without a trailing slash. */
    get origin(): string;
    /** Observe session changes. Loading a stored session does not notify. Returns an unsubscribe function. */
    subscribe(listener: DeepSpaceExpoSessionListener): () => void;
    getSession(): Promise<DeepSpaceExpoSession | null>;
    signIn(provider?: ExpoAuthProvider, state?: string): Promise<DeepSpaceExpoUser>;
    signInWithGoogle(state?: string): Promise<DeepSpaceExpoUser>;
    /** Mint a fresh bearer from the stored session. Concurrent callers share one request. */
    refresh(): Promise<string | null>;
    private refreshOnce;
    getAuthToken(): Promise<string | null>;
    me(): Promise<DeepSpaceExpoUser>;
    request<T>(path: string, init?: RequestInit, retried?: boolean): Promise<T>;
    signOut(): Promise<void>;
    private json;
    private saveSession;
    private clearSession;
    private writeStorage;
    private notify;
    private fetchWithTimeout;
}

/**
 * SecureStore keys may contain only letters, digits, ".", "-" and "_", so a URL
 * cannot be used directly. Every other character (and "_" itself) becomes
 * `_<hex>_`, which keeps the key unique per origin.
 */
declare function defaultStorageKey(baseUrl: string): string;

export { DeepSpaceExpoClient, type DeepSpaceExpoClientOptions, DeepSpaceExpoError, type DeepSpaceExpoSession, type DeepSpaceExpoSessionListener, type DeepSpaceExpoUser, DeepSpaceSignInCancelledError, type ExpoAuthPaths, type ExpoAuthProvider, type ExpoAuthStorage, buildExpoOAuthStartUrl, codeFromExpoRedirect, createDeepSpaceExpoClient, defaultStorageKey, normalizeExpoBaseUrl, stateFromExpoRedirect };