/** User object — framework-agnostic, provider-agnostic */
interface User {
    uid: string;
    email: string | null;
    displayName: string | null;
    photoURL: string | null;
    roles: string[];
}
/** Auth state */
type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';
interface AuthState {
    user: User | null;
    status: AuthStatus;
}
/** OAuth providers */
type OAuthProvider = string;
/**
 * AuthAdapter — interface implemented by provider adapters (e.g. Firebase, Supabase, Auth0).
 * Consumers must provide an implementation of this adapter to the AuthProvider.
 */
interface AuthAdapter {
    signIn(email: string, password: string): Promise<User>;
    signInWithOAuth(provider: OAuthProvider): Promise<User>;
    signUp(email: string, password: string, displayName: string): Promise<User>;
    signOut(): Promise<void>;
    resetPassword(email: string): Promise<void>;
    getToken(): Promise<string | null>;
    onAuthStateChange(callback: (user: User | null) => void): () => void;
}
interface AuthConfig {
    /** The adapter implementation for your specific auth provider (Supabase, Firebase, Auth0, Custom, etc.) */
    adapter: AuthAdapter;
    /** Token refresh interval in minutes. Default: 50 */
    tokenRefreshInterval?: number;
    /** Enable E2E test mode with mock user */
    testMode?: boolean;
    /** Mock user for test mode */
    testUser?: User;
}

interface AuthAPI {
    getState(): AuthState;
    signIn(email: string, password: string): Promise<User>;
    signInWithOAuth(provider: OAuthProvider): Promise<User>;
    signUp(email: string, password: string, displayName: string): Promise<User>;
    signOut(): Promise<void>;
    resetPassword(email: string): Promise<void>;
    getToken(): Promise<string | null>;
    subscribe(fn: (state: AuthState) => void): () => void;
    destroy(): void;
}
declare function createAuth(adapter: AuthAdapter, config?: Omit<AuthConfig, 'adapter'>): AuthAPI;

/** Check if user has a specific role */
declare function hasRole(user: User | null, role: string): boolean;
/** Check if user has any of the specified roles */
declare function hasAnyRole(user: User | null, roles: string[]): boolean;
/** Check if user has all of the specified roles */
declare function hasAllRoles(user: User | null, roles: string[]): boolean;
/** Convenience role checks */
declare function canAccessAdmin(user: User | null): boolean;
declare function canAccessReviewer(user: User | null): boolean;
/** Get the default portal URL based on highest-privilege role */
declare function getDefaultPortal(roles: string[]): string;
/** Get roles that the given user can assign to others */
declare function getAssignableRoles(user: User | null): string[];

/**
 * Mock auth adapter for testing and development.
 * No external dependencies. Stores state in memory.
 */
declare function createMockAdapter(initialUser?: User): AuthAdapter;

export { type AuthAPI, type AuthAdapter, type AuthConfig, type AuthState, type AuthStatus, type OAuthProvider, type User, canAccessAdmin, canAccessReviewer, createAuth, createMockAdapter, getAssignableRoles, getDefaultPortal, hasAllRoles, hasAnyRole, hasRole };
