import { SupabaseClient, Provider, Session } from '@supabase/supabase-js';

interface SupabaseSessionOptions {
    /** OAuth provider. Default: 'google'. Example: 'google' | 'github' | 'azure' */
    provider?: Provider;
    /** URL the OAuth flow returns to (page should load Supabase with `detectSessionInUrl:true`). */
    redirectTo?: string;
    /** `window.open` features string. */
    popupFeatures?: string;
    /** Milliseconds before login is considered timed out. Default: 120_000. */
    timeoutMs?: number;
    /** Provider-specific OAuth scopes. E.g. "email profile openid" */
    scopes?: string;
    /** Extra provider query params. E.g. { access_type: "offline", prompt: "consent" } */
    queryParams?: Record<string, string>;
    /** Hook invoked once a session is available. */
    onSignedIn?: (session: Session) => void;
}
/**
 * Popup OAuth and resolve to a Supabase `Session` once signed in.
 *
 * const supabase = createClient("https://PROJECT.supabase.co", "KEY", { auth: {...} });
 * const session = await ensureSupabaseSession(supabase, { provider: "google" });
 *
 * How it works (high level)
 * 1) If a session already exists, return it.
 * 2) Else, ask Supabase for an OAuth URL with `{ skipBrowserRedirect: true }`.
 * 3) Try to open a popup; if blocked (no user gesture), fall back to full-page redirect.
 * 4) On completion, Supabase stores session and **broadcasts** `SIGNED_IN` to same-origin tabs.
 *    We listen for that (preferred), and also for a `postMessage` backup from the popup.
 *
 * Why backup? Broadcast can be delayed by some browser/storage quirks. The popup can call:
 *   `window.opener?.postMessage({ type: 'supabase:SIGNED_IN' }, origin)`
 * We listen for both and resolve the first that arrives.
 */
declare function ensureSupabaseSession(client: SupabaseClient, { provider, redirectTo, popupFeatures, timeoutMs, scopes, queryParams, onSignedIn, }?: SupabaseSessionOptions): Promise<Session>;

export { type SupabaseSessionOptions, ensureSupabaseSession as default, ensureSupabaseSession };