/**
 * Authentication Service
 *
 * Handles user authentication (email/password and OAuth),
 * session persistence, and token management.
 *
 * Session tokens are encrypted at rest using AES-256-GCM with
 * a machine-derived encryption key.
 */
import type { AuthSession, LoginCredentials, Tier, User } from '../types/auth.js';
export declare class AuthService {
    private apiUrl;
    private session;
    constructor(apiUrl?: string);
    private ensureAuthDir;
    /**
     * Get or create the encryption salt
     */
    private getOrCreateSalt;
    /**
     * Derive the encryption key from machine ID and salt
     */
    private getEncryptionKey;
    /**
     * Encrypt a session for storage
     */
    private encryptSession;
    /**
     * Decrypt an encrypted session file
     */
    private decryptSession;
    /**
     * Check if a session file is encrypted (v2) or plaintext (v1)
     */
    private isEncryptedSession;
    private loadSession;
    private saveSession;
    private clearSession;
    login(credentials: LoginCredentials): Promise<AuthSession>;
    logout(): Promise<void>;
    refreshSession(): Promise<AuthSession | null>;
    getSession(): AuthSession | null;
    isAuthenticated(): boolean;
    getUser(): User | null;
    getTier(): Tier;
    hasPlusDiscount(): boolean;
    getToken(): string | null;
    loginWithOAuth(provider: 'google' | 'github', signal?: AbortSignal): Promise<void>;
    private openBrowser;
    private startCallbackServer;
    isFirstLaunch(): boolean;
    markFirstLaunchSeen(): void;
    wasFirstLaunchSeen(): boolean;
}
export declare function getAuthService(): AuthService;
//# sourceMappingURL=auth-service.d.ts.map