/**
 * `auth` namespace — project-scoped user authentication: magic links, password
 * set/change, auth settings, and admin role promotion/demotion.
 *
 * Magic link + password ops use the project's anon key (they represent
 * end-user flows). Settings + promote/demote use the service key.
 */
import type { Client } from "../kernel.js";
export type EmailAuthDelivery = "link" | "code" | "both";
interface MagicLinkOptionsBase {
    email: string;
    intent?: "signin" | "invite" | "claim" | "recovery";
    clientState?: unknown;
}
export type MagicLinkOptions = (MagicLinkOptionsBase & {
    delivery?: "link";
    redirectUrl: string;
}) | (MagicLinkOptionsBase & {
    delivery: "both";
    redirectUrl: string;
}) | (MagicLinkOptionsBase & {
    delivery: "code";
    redirectUrl?: string;
});
export interface MagicLinkRequestWarning {
    code: string;
    message: string;
    [key: string]: unknown;
}
export interface MagicLinkRequestResult {
    message: string;
    warnings?: MagicLinkRequestWarning[];
    challengeId?: string;
}
export interface EmailCodeVerifyOptions {
    challengeId: string;
    code: string;
}
export interface MagicLinkUser {
    id: string;
    email: string;
}
export interface MagicLinkVerifyResult {
    access_token: string;
    refresh_token: string;
    token_type: string;
    expires_in: number;
    user: MagicLinkUser;
    magic_link?: {
        intent: "signin" | "invite" | "claim" | "recovery";
        client_state: string | null;
        state_source: "anonymous" | "service_key";
        state_trusted: boolean;
        delivery?: EmailAuthDelivery;
        verified_with?: "link" | "email_code";
    };
}
export interface AuthProvidersResult {
    magic_link: {
        enabled: boolean;
        /** Capability-gated email modes. Absent means link-only compatibility. */
        deliveryModes: EmailAuthDelivery[];
    };
    [key: string]: unknown;
}
export interface SetPasswordOptions {
    accessToken: string;
    newPassword: string;
    /** Required for password change; omit for reset (via magic link) or initial set. */
    currentPassword?: string;
}
export interface AuthSettings {
    allow_password_set?: boolean;
    preferred_sign_in_method?: "password" | "magic_link" | "oauth_google" | "passkey" | null;
    public_signup?: "open" | "known_email" | "invite_only";
    require_passkey_for_project_admin?: boolean;
    /**
     * Restrict hosted Google sign-in to these email domains, enforced at token
     * issuance. `[]` or omitted = unrestricted. Entries are normalized
     * (lowercased, leading `@` stripped, trimmed, deduped) and domain-validated
     * server-side; pass an explicit `[]` to clear an existing restriction.
     */
    allowed_email_domains?: string[];
}
export interface AuthSettingsResult {
    allow_password_set: boolean;
    preferred_sign_in_method: "password" | "magic_link" | "oauth_google" | "passkey" | null;
    public_signup: "open" | "known_email" | "invite_only";
    require_passkey_for_project_admin: boolean;
    /** Normalized email-domain allowlist for hosted Google sign-in; `[]` = unrestricted. */
    allowed_email_domains: string[];
}
export interface CreateAuthUserOptions {
    email: string;
    isAdmin?: boolean;
    sendInvite?: boolean;
    redirectUrl?: string;
    clientState?: unknown;
}
export interface AuthUserAdminResult {
    id: string;
    email: string;
    is_admin: boolean;
    email_verified_at: string | null;
    created: boolean;
    invite_sent: boolean;
}
export interface AuthSessionResult extends MagicLinkVerifyResult {
    elevation_required?: boolean;
    required_method?: "passkey";
    effective_role?: "authenticated";
    intended_role?: "project_admin";
}
export interface PasskeyOptionsResult {
    challenge_id: string;
    options: unknown;
}
export interface PasskeyRecord {
    id: string;
    rp_id: string;
    created_origin: string;
    last_used_origin?: string | null;
    transports: string[];
    label: string | null;
    credential_device_type: string | null;
    credential_backed_up: boolean | null;
    created_at: string;
    last_used_at: string | null;
}
export interface PasskeyRegistrationOptions {
    accessToken: string;
    appOrigin: string;
}
export interface PasskeyRegistrationVerifyOptions {
    accessToken: string;
    challengeId: string;
    response: unknown;
    label?: string;
}
export interface PasskeyLoginOptions {
    appOrigin: string;
    email?: string;
}
export interface PasskeyLoginVerifyOptions {
    challengeId: string;
    response: unknown;
}
export interface PasskeyListOptions {
    accessToken: string;
}
export interface PasskeyDeleteOptions {
    accessToken: string;
    passkeyId: string;
}
export declare class Auth {
    private readonly client;
    readonly magicLink: (projectId: string, opts: MagicLinkOptions) => Promise<MagicLinkRequestResult>;
    readonly verify: (projectId: string, token: string) => Promise<MagicLinkVerifyResult>;
    readonly setPassword: (projectId: string, opts: SetPasswordOptions) => Promise<void>;
    readonly promoteUser: (projectId: string, email: string) => Promise<void>;
    readonly demoteUser: (projectId: string, email: string) => Promise<void>;
    constructor(client: Client);
    /** Request a passwordless email credential. Link remains the wire default. */
    requestMagicLink(projectId: string, opts: MagicLinkOptions): Promise<MagicLinkRequestResult>;
    /** Exchange a magic-link token for access + refresh tokens. */
    verifyMagicLink(projectId: string, token: string): Promise<MagicLinkVerifyResult>;
    /** Exchange an opaque challenge handle plus a six-digit code. Never auto-retried. */
    verifyEmailCode(projectId: string, opts: EmailCodeVerifyOptions): Promise<MagicLinkVerifyResult>;
    /**
     * Set / change / reset the authenticated user's password. The caller's
     * `accessToken` (from `verifyMagicLink` or a prior login) is used as the
     * Bearer credential.
     */
    setUserPassword(projectId: string, opts: SetPasswordOptions): Promise<void>;
    /** Update project-level auth settings. Requires service key. */
    settings(projectId: string, settings: AuthSettings): Promise<AuthSettingsResult>;
    /** Create or update an auth user. Requires service key. */
    createUser(projectId: string, opts: CreateAuthUserOptions): Promise<AuthUserAdminResult>;
    /** Create/update an auth user and send a trusted invite. Requires service key. */
    inviteUser(projectId: string, opts: Omit<CreateAuthUserOptions, "sendInvite">): Promise<AuthUserAdminResult>;
    /** Create WebAuthn registration options for the authenticated user. */
    createPasskeyRegistrationOptions(projectId: string, opts: PasskeyRegistrationOptions): Promise<PasskeyOptionsResult>;
    /** Verify and store a WebAuthn passkey registration. */
    verifyPasskeyRegistration(projectId: string, opts: PasskeyRegistrationVerifyOptions): Promise<PasskeyRecord>;
    /** Create WebAuthn login options. */
    createPasskeyLoginOptions(projectId: string, opts: PasskeyLoginOptions): Promise<PasskeyOptionsResult>;
    /** Verify a WebAuthn login assertion and return a normal auth session. */
    verifyPasskeyLogin(projectId: string, opts: PasskeyLoginVerifyOptions): Promise<AuthSessionResult>;
    /** List the authenticated user's active passkeys. */
    listPasskeys(projectId: string, opts: PasskeyListOptions): Promise<{
        passkeys: PasskeyRecord[];
    }>;
    /** Delete one authenticated-user passkey by id. */
    deletePasskey(projectId: string, opts: PasskeyDeleteOptions): Promise<void>;
    /** List configured auth providers for a project. Uses the project's anon key. */
    providers(projectId: string): Promise<AuthProvidersResult>;
    /** Promote a user (by email) to `project_admin`. Requires service key. */
    promote(projectId: string, email: string): Promise<void>;
    /** Demote a user (by email) from `project_admin` back to the default role. */
    demote(projectId: string, email: string): Promise<void>;
}
export {};
//# sourceMappingURL=auth.d.ts.map