/**
 * Authentication Service
 *
 * Handles user authentication (email/password and OAuth),
 * session persistence, and token management.
 *
 * Session tokens are encrypted at rest using AES-256-GCM with
 * a machine-derived encryption key.
 */
import type { AuthSession, LoginCredentials, Tier, User } from '../types/auth.js';
export declare class AuthService {
    private apiUrl;
    private session;
    constructor(apiUrl?: string);
    private ensureAuthDir;
    /**
     * Get or create the encryption salt
     */
    private getOrCreateSalt;
    /**
     * Derive the encryption key from machine ID and salt
     */
    private getEncryptionKey;
    /**
     * Encrypt a session for storage
     */
    private encryptSession;
    /**
     * Decrypt an encrypted session file
     */
    private decryptSession;
    /**
     * Check if a session file is encrypted (v2) or plaintext (v1)
     */
    private isEncryptedSession;
    private loadSession;
    private saveSession;
    private clearSession;
    login(credentials: LoginCredentials): Promise<AuthSession>;
    logout(): Promise<void>;
    refreshSession(): Promise<AuthSession | null>;
    getSession(): AuthSession | null;
    isAuthenticated(): boolean;
    getUser(): User | null;
    getTier(): Tier;
    hasPlusDiscount(): boolean;
    getToken(): string | null;
    /**
     * Check if the user's subscription tier has expired based on cached expiry timestamp.
     * Returns true if tierExpiresAt is set and has passed.
     */
    isTierExpired(): boolean;
    /**
     * Get the user's effective tier, accounting for offline expiry.
     * If the cached tier has expired, falls back to plus (if hasPlusDiscount) or free.
     */
    getEffectiveTier(): Tier;
    /**
     * Login using a Personal Access Token (PAT) for headless servers.
     * Validates the token against the API and creates a local session.
     */
    loginWithToken(token: string): Promise<AuthSession>;
    loginWithOAuth(provider: 'google' | 'github', signal?: AbortSignal): Promise<void>;
    private openBrowser;
    private startCallbackServer;
    isFirstLaunch(): boolean;
    markFirstLaunchSeen(): void;
    wasFirstLaunchSeen(): boolean;
}
export declare function getAuthService(): AuthService;
//# sourceMappingURL=auth-service.d.ts.map