/** Where a login originated, recorded for analytics + login_events. */
export type LoginSource = 'cli' | 'mcp' | 'desktop' | 'core' | 'tryout';
export type GoogleLoginOptions = {
    redirectOrigin?: string;
    source?: LoginSource;
    editor?: string;
    version?: string;
};
type LoginResponse = {
    success: boolean;
    token?: string;
    refreshToken?: string;
    user?: {
        id: string;
        email: string;
        displayName?: string;
    };
    profile?: {
        remaining_spend_usd: number;
        monthly_limit_usd: number;
        current_month_spend_usd: number;
        total_spend_usd: number;
    };
    error?: string;
    message?: string;
};
type UserProfile = {
    user: {
        id: string;
        email: string;
        displayName?: string;
    };
    profile: {
        remaining_spend_usd: number;
        monthly_limit_usd: number;
        current_month_spend_usd: number;
        total_spend_usd: number;
        created_at: string;
    };
};
/**
 * AuthService handles authentication with the Rivet proxy server
 */
export declare class AuthService {
    private proxyUrl;
    private configManager;
    constructor(proxyUrl?: string);
    /**
     * Sign in with email and password via the proxy's email/signin endpoint.
     * Used in CI when RIVET_E2E_EMAIL / RIVET_E2E_PASSWORD (or RIVET_TEST_*) are set.
     * Uses this.proxyUrl (set via constructor).
     */
    loginWithEmailPassword(email: string, password: string): Promise<LoginResponse>;
    /**
     * Start Google OAuth flow
     * Opens browser for user to authenticate, then polls for token.
     *
     * Accepts either a bare `redirectOrigin` string (legacy call sites) or an
     * options object carrying the login `source`/`editor`/`version` recorded by
     * the proxy for analytics + login_events.
     * redirectOrigin: e.g. http://localhost:4000 or http://localhost:4000/rivet — OAuth callback redirects there with ?session= (used when Rivet runs on a dynamic port).
     */
    loginWithGoogle(optionsOrRedirectOrigin?: string | GoogleLoginOptions): Promise<LoginResponse>;
    /**
     * Poll the proxy server for authentication token after OAuth
     */
    private pollForToken;
    /**
     * Logout (clear local token and invalidate on server)
     */
    logout(): Promise<void>;
    /**
     * Get user profile and spending info
     */
    getProfile(): Promise<UserProfile | null>;
    /**
     * Server-validates auth for per-tool MCP gating. A local token only counts as
     * authenticated after the proxy accepts it, and rejected tokens get one
     * refresh-and-retry attempt through `getValidatedProfile()`.
     */
    ensureAuthenticated(): Promise<boolean>;
    /**
     * Server-validated auth check: fetch the profile, and if the token is
     * rejected (401), refresh once and retry. Returns the profile when the user
     * is genuinely authenticated, otherwise null. Use this instead of
     * `isAuthenticated()` (which only checks for a token's presence) wherever a
     * stale token must be treated as logged-out.
     */
    getValidatedProfile(): Promise<UserProfile | null>;
    /**
     * Check if user is authenticated
     */
    isAuthenticated(): boolean;
    /**
     * Get current auth token
     */
    getAuthToken(): string | undefined;
}
export {};
//# sourceMappingURL=AuthService.d.ts.map