/**
 * Reactive state for cookie-based authentication.
 *
 * SPA auth pattern: prerendered static HTML served by Hono, no SvelteKit
 * server for SSR sessions. On load, fetches `GET /api/account/status` which
 * returns the current account (200) or 401 with optional `bootstrap_available`.
 * Login sends username + password once, then a signed httpOnly cookie handles
 * all subsequent requests.
 *
 * @example
 * ```svelte
 * <script lang="ts">
 * 	import {AuthState, auth_state_context} from '@fuzdev/fuz_app/ui/auth_state.svelte.js';
 *
 * 	const auth = new AuthState();
 * 	auth_state_context.set(auth);
 * 	auth.check_session();
 * </script>
 *
 * {#if auth.verifying}
 * 	<p>checking session…</p>
 * {:else if auth.needs_bootstrap}
 * 	<BootstrapForm />
 * {:else if !auth.verified}
 * 	<LoginForm />
 * {:else}
 * 	<p>logged in as {auth.account?.username}</p>
 * 	<button onclick={() => auth.logout()}>logout</button>
 * {/if}
 * ```
 *
 * @module
 */
import { type ActorSummaryJson, type RoleGrantSummaryJson, type SessionAccount } from '../auth/account_schema.js';
/**
 * Svelte context for `AuthState`.
 * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
 */
export declare const auth_state_context: {
    get: (error_message?: string) => AuthState;
    get_maybe: () => AuthState | undefined;
    set: (value: AuthState) => AuthState;
};
export declare class AuthState {
    verifying: boolean;
    verified: boolean;
    verify_error: string | null;
    account: SessionAccount | null;
    actor: ActorSummaryJson | null;
    role_grants: Array<RoleGrantSummaryJson>;
    readonly active_role_grants: Array<RoleGrantSummaryJson>;
    readonly roles: Array<string>;
    /** True when bootstrap is available (no accounts exist yet). */
    needs_bootstrap: boolean;
    /**
     * Check auth state and bootstrap availability.
     *
     * Fetches `GET /api/account/status` — returns account info (200) or
     * 401 with optional `bootstrap_available` flag.
     * Called on init, and after login/bootstrap to refresh state.
     *
     * @mutates `this`
     */
    check_session(): Promise<void>;
    /**
     * Log in with username and password. Translates 401 / 429 to friendly
     * messages on `verify_error`; refreshes the session via `check_session`
     * on success.
     *
     * @returns `true` if login succeeded, `false` otherwise
     * @mutates `this`
     */
    login(username: string, password: string): Promise<boolean>;
    /**
     * Bootstrap the first keeper account using a single-use token.
     *
     * @returns `true` if bootstrap succeeded, `false` otherwise
     * @mutates `this`
     */
    bootstrap(token: string, username: string, password: string): Promise<boolean>;
    /**
     * Sign up via invite (or open signup, when `app_settings.open_signup`
     * is true server-side). Translates 403 / 409 / 429 to friendly messages
     * on `verify_error`.
     *
     * @returns `true` if signup succeeded, `false` otherwise
     * @mutates `this`
     */
    signup(username: string, password: string, email?: string): Promise<boolean>;
    /**
     * Log out — best-effort `POST /api/account/logout` to clear the session
     * cookie, then clears local state regardless of the network outcome.
     *
     * @mutates `this`
     */
    logout(): Promise<void>;
}
//# sourceMappingURL=auth_state.svelte.d.ts.map