import * as _platform_modules_auth from '@platform-modules/auth';
import { Principal, SignInCredentials } from '@platform-modules/auth';
export { Principal, SignInCredentials } from '@platform-modules/auth';
import * as react from 'react';
import { ReactNode } from 'react';

/** Minimal sign-up payload; host routes may extend with additional fields. */
type SignUpInput = {
    email: string;
    password: string;
};
/**
 * Injected data seam for browser-side auth.
 * The consumer wires each method to its authenticated API route — sessions stay server-managed.
 */
interface AuthClient {
    getCurrentUser(): Promise<Principal | null>;
    signIn(creds: SignInCredentials): Promise<Principal>;
    signUp(input: SignUpInput): Promise<Principal>;
    signOut(): Promise<void>;
    requestPasswordReset(email: string): Promise<void>;
    resetPassword(token: string, newPassword: string): Promise<void>;
}

/** Typed boundary error when the session is no longer valid. */
declare class AuthSessionExpiredError extends Error {
    readonly name = "AuthSessionExpiredError";
    constructor(message?: string);
}
declare function isAuthSessionExpiredError(e: unknown): e is AuthSessionExpiredError;
declare class AuthProviderError extends Error {
    readonly name = "AuthProviderError";
    constructor(hook: string);
}
declare function isAuthProviderError(e: unknown): e is AuthProviderError;

/** Holds the current Principal snapshot and refreshes it on mount. */
declare function AuthProvider({ client, children }: {
    client: AuthClient;
    children: ReactNode;
}): react.JSX.Element;

declare function useCurrentUser(): {
    user: _platform_modules_auth.Principal | null;
    loading: boolean;
    error: Error | null;
    reload: () => void;
};

declare function useSignIn(): {
    signIn: (creds: SignInCredentials) => Promise<Principal>;
    pending: boolean;
    error: Error | null;
};

declare function useSignUp(): {
    signUp: (input: SignUpInput) => Promise<Principal>;
    pending: boolean;
    error: Error | null;
};

declare function useSignOut(): {
    signOut: () => Promise<void>;
    pending: boolean;
    error: Error | null;
};

declare function usePasswordReset(): {
    request: (email: string) => Promise<void>;
    reset: (token: string, newPassword: string) => Promise<void>;
    pending: boolean;
    error: Error | null;
};

interface RequireRoleProps {
    role: string;
    hierarchy?: readonly string[];
    fallback?: ReactNode;
    children: ReactNode;
}
/**
 * UX-only role guard — hides children when the current user lacks the required role.
 * Authorization path: `isAtLeastRole` from `@platform-modules/auth` when `hierarchy` is
 * provided; otherwise exact `principal.roles` membership. The server route MUST
 * re-authorize; hiding a button is not access control.
 */
declare function RequireRole({ role, hierarchy, fallback, children }: RequireRoleProps): ReactNode;

interface RequireCapabilityProps {
    capability: string;
    fallback?: ReactNode;
    children: ReactNode;
}
/**
 * UX-only capability guard — hides children when the current user lacks the capability.
 * Authorization path: `hasPermission` from `@platform-modules/auth`. The server route
 * MUST re-authorize; hiding a button is not access control.
 */
declare function RequireCapability({ capability, fallback, children }: RequireCapabilityProps): ReactNode;

export { type AuthClient, AuthProvider, AuthProviderError, AuthSessionExpiredError, RequireCapability, type RequireCapabilityProps, RequireRole, type RequireRoleProps, type SignUpInput, isAuthProviderError, isAuthSessionExpiredError, useCurrentUser, usePasswordReset, useSignIn, useSignOut, useSignUp };