import { ChainEnum, WalletProviderEnum, type FetchAPI } from '@dynamic-labs/sdk-api-core';
export interface CreateAuthClientOptions {
    environmentId: string;
    baseUrl?: string;
    /** Custom fetch implementation (tests, proxies). */
    fetchApi?: FetchAPI;
    /** Origin SIWE sign-ins present as — must be on the environment's allowlisted CORS origins. signIn derives domain/uri from it; per-call params override. */
    appOrigin?: string;
}
export interface AuthResult {
    /** Pass to DynamicWalletClient.authenticateJwt. Custody is yours; never log it. */
    jwt: string;
    expiresAt: number;
    userId?: string;
}
export interface DynamicAuthClient {
    email: {
        sendOtp(email: string): Promise<{
            verificationUUID: string;
        }>;
        verifyOtp(params: {
            verificationUUID: string;
            code: string;
            /** Compressed P-256 hex from generateSessionKeyPair — binds the session key into the minted JWT. */
            sessionPublicKey?: string;
        }): Promise<AuthResult>;
    };
    wallet: {
        getNonce(): Promise<{
            nonce: string;
        }>;
        createMessage(params: {
            domain: string;
            address: string;
            uri: string;
            chainId: number;
            nonce: string;
            statement?: string;
            issuedAt?: string;
        }): string;
        verify(params: {
            message: string;
            signature: string;
            walletAddress: string;
            sessionPublicKey?: string;
            walletName?: string;
            walletProvider?: WalletProviderEnum;
            chain?: ChainEnum;
        }): Promise<AuthResult>;
        /** One-call SIWE sign-in: nonce → message (built internally) → your signMessage callback → verify. Key custody stays behind the callback. */
        signIn(params: {
            address: string;
            signMessage: (message: string) => Promise<string>;
            sessionPublicKey?: string;
            domain?: string;
            uri?: string;
            /** EVM-specific. Default 1. */
            chainId?: number;
            statement?: string;
            walletName?: string;
            walletProvider?: WalletProviderEnum;
        }): Promise<AuthResult>;
    };
    externalJwt: {
        /** Exchanges a JWT from the environment's configured external issuer (BYOA) for a Dynamic user JWT. */
        signIn(params: {
            jwt: string;
            sessionPublicKey?: string;
        }): Promise<AuthResult>;
    };
}
/**
 * Headless auth client: mints a Dynamic user JWT (email OTP or SIWE) for use
 * with authenticateJwt. Holds configuration only — no secrets, no persistence.
 */
export declare function createAuthClient(options: CreateAuthClientOptions): DynamicAuthClient;
//# sourceMappingURL=authClient.d.ts.map