import { BIP340KeygenResult, EcdsaKeygenResult, EcdsaSignature, MessageHash, type EcdsaPublicKey } from '#internal/node';
import { BackupLocation, type DynamicApiClient, ThresholdSignatureScheme, type ILogger, WalletOperation, type BitcoinConfig, type KeyShareBackupInfo, type RequestWithElevatedAccessToken, type ShareSetType } from '@dynamic-labs-wallet/core';
import { ForwardMPCClientV2 } from '@dynamic-labs-wallet/forward-mpc-client';
import type { SignMessageContext } from '@dynamic-labs/sdk-api-core';
import type { ServerKeyShare } from './mpc/index.js';
import type { ServerInitKeygenResult } from './mpc/types.js';
import type { DynamicWalletClientProps, WalletMetadata, WalletProperties } from './types.js';
type RawPublicKey = EcdsaPublicKey | Uint8Array | string | undefined;
export declare class DynamicWalletClient {
    environmentId: string;
    debug: boolean;
    protected logger: ILogger;
    protected apiClient: DynamicApiClient;
    protected baseMPCRelayApiUrl?: string;
    protected baseJWTAuthToken?: string;
    protected baseApiUrl?: string;
    protected isApiClientAuthenticated: boolean;
    protected forwardMPCEnabled: boolean;
    protected resolvedForwardMPCClient: ForwardMPCClientV2 | undefined;
    protected getSessionSignature?: (message: string) => Promise<string>;
    private readonly nonceBatchSize;
    private readonly nonceCache;
    private nonceRefill?;
    private nonceAuthGeneration;
    constructor({ environmentId, baseApiUrl, baseMPCRelayApiUrl, debug, forwardMPCClient, enableMPCAccelerator, logger, }: DynamicWalletClientProps);
    private ensureApiClientAuthenticated;
    /**
     * Guards against silent operate-on-different-wallet bugs when callers pass
     * both `accountAddress` and `walletMetadata`. Throws when either is missing
     * or when they disagree.
     *
     * Comparison is case-insensitive only for EVM (where checksum casing is
     * decoration over an underlying hex address). SVM (base58), BTC base58,
     * and TON (base64url) are case-sensitive — two addresses that differ only
     * in case are different addresses.
     */
    private assertAddressMatchesMetadata;
    /**
     * Installs a Dynamic JWT as the bearer token for all subsequent API calls
     * and rebuilds the API client, preserving the forward-MPC client.
     */
    private setAuthenticatedJwt;
    authenticateApiToken(authToken: string): Promise<void>;
    /**
     * Authenticates the client with a Dynamic user JWT obtained outside the SDK —
     * e.g. by an agent that completed a Dynamic sign-in (external auth, email OTP)
     * on behalf of a user. Unlike authenticateApiToken, no token exchange happens:
     * the JWT is used directly as the bearer token. The server validates it on
     * every request; this method only checks the token's structure.
     *
     * `options.getSessionSignature` must return the signature as lowercase hex
     * (raw ECDSA r‖s, as produced by `signSessionMessage`). Other encodings —
     * notably base64, which can contain `/` — corrupt the `/`-delimited
     * signed-session composite sent to the keyshares relay.
     */
    authenticateJwt(jwt: string, options?: {
        getSessionSignature?: (message: string) => Promise<string>;
    }): Promise<void>;
    private buildSignedSessionId;
    private takeNonce;
    /**
     * Refreshes the Dynamic JWT using the current session and installs the new
     * token for all subsequent API calls. Returns the new JWT so callers can
     * persist it. The server enforces a hard refresh limit (the JWT's
     * `refreshExp` claim) — once reached, this rejects with a 401 and the user
     * must re-authenticate.
     */
    refreshAuthToken(): Promise<string>;
    /**
     * Fetches non-sensitive wallet identity (walletId, accountAddress, chainName,
     * derivationPath, thresholdSignatureScheme) from the Dynamic API by
     * `accountAddress`. SDK-scoped — works with the customer auth token from
     * `authenticateApiToken`.
     *
     * **What this returns and what it does NOT return:**
     * - Returns: wallet identity fields above.
     * - Does NOT return: `externalServerKeySharesBackupInfo` (the per-share
     *   pointer metadata that drives recovery), `addressType`, or any
     *   encrypted material. The byAddress endpoint is intentionally a slim
     *   identity lookup; pointer metadata and addressType only come from the
     *   `createWalletAccount` / `importPrivateKey` return values.
     *
     * **Customer responsibility:**
     * Persist the FULL `walletMetadata` returned by `createWalletAccount` /
     * `importPrivateKey` (which includes `externalServerKeySharesBackupInfo` and
     * `addressType`). `fetchWalletMetadata` recovers identity only — it cannot
     * substitute for a properly-cached `walletMetadata` after a Redis wipe if
     * the operation needs `backupInfo` (sign with auto-recovery, password
     * checks, refresh, etc.).
     *
     * Does not cache, does not mutate SDK state.
     */
    fetchWalletMetadata(accountAddress: string): Promise<WalletMetadata>;
    /**
     * Returns the cached `externalServerKeySharesBackupInfo` from
     * `walletMetadata`. The Dynamic API does not currently expose a SDK-scoped
     * endpoint that returns the keyShare pointer metadata by address (only the
     * unbounded `getUser` does, which we avoid for server wallets). So the
     * customer must persist the full `walletMetadata` (with backupInfo)
     * returned by `createWalletAccount` / `importPrivateKey` and pass it back
     * in on subsequent calls. Throws loudly when missing — never silently
     * synthesizes empty state.
     */
    protected resolveBackupInfo(walletMetadata: WalletMetadata): Promise<KeyShareBackupInfo>;
    dynamicServerInitializeKeyGen({ chainName, externalServerKeygenIds, thresholdSignatureScheme, dynamicRequestId, skipLock, bitcoinConfig, onError, onCeremonyComplete, }: {
        chainName: string;
        externalServerKeygenIds: string[];
        thresholdSignatureScheme: ThresholdSignatureScheme;
        dynamicRequestId: string;
        skipLock?: boolean;
        bitcoinConfig?: BitcoinConfig;
        onError?: (error: Error) => void;
        onCeremonyComplete?: (accountAddress: string, walletId: string, shareSetId?: string, shareSetType?: ShareSetType) => void;
    }): Promise<import("@dynamic-labs-wallet/core").KeygenCompleteResponse>;
    externalServerInitializeKeyGen({ chainName, thresholdSignatureScheme, bitcoinConfig, }: {
        chainName: string;
        thresholdSignatureScheme: ThresholdSignatureScheme;
        bitcoinConfig?: BitcoinConfig;
    }): Promise<ServerInitKeygenResult[]>;
    derivePublicKey({ chainName, keyShare, derivationPath, bitcoinConfig, }: {
        chainName: string;
        keyShare: ServerKeyShare;
        derivationPath: Uint32Array | undefined;
        bitcoinConfig?: BitcoinConfig;
    }): Promise<string | EcdsaPublicKey | Uint8Array | undefined>;
    forwardMPCExternalServerKeyGen({ chainName, roomId, dynamicServerKeygenIds, externalServerInitKeygenResults, thresholdSignatureScheme, bitcoinConfig, }: {
        chainName: string;
        roomId: string;
        dynamicServerKeygenIds: string[];
        externalServerInitKeygenResults: ServerInitKeygenResult[];
        thresholdSignatureScheme: ThresholdSignatureScheme;
        bitcoinConfig?: BitcoinConfig;
    }): Promise<{
        rawPublicKey: RawPublicKey;
        externalServerKeyGenResults: ServerKeyShare[];
    }>;
    externalServerKeyGen({ chainName, roomId, dynamicServerKeygenIds, externalServerInitKeygenResults, thresholdSignatureScheme, bitcoinConfig, }: {
        chainName: string;
        roomId: string;
        dynamicServerKeygenIds: string[];
        externalServerInitKeygenResults: ServerInitKeygenResult[];
        thresholdSignatureScheme: ThresholdSignatureScheme;
        bitcoinConfig?: BitcoinConfig;
    }): Promise<{
        rawPublicKey: RawPublicKey;
        externalServerKeyGenResults: ServerKeyShare[];
    }>;
    protected validatePasswordForBackup({ password, backUpToDynamic }: {
        password?: string;
        backUpToDynamic?: boolean;
    }): void;
    keyGen({ chainName, thresholdSignatureScheme, skipLock, bitcoinConfig, password, backUpToDynamic, onError, onCeremonyComplete, }: {
        chainName: string;
        thresholdSignatureScheme: ThresholdSignatureScheme;
        skipLock?: boolean;
        bitcoinConfig?: BitcoinConfig;
        password?: string;
        backUpToDynamic?: boolean;
        onError?: (error: Error) => void;
        onCeremonyComplete?: (accountAddress: string, walletId: string, shareSetId?: string, shareSetType?: ShareSetType) => void;
    }): Promise<{
        rawPublicKey: RawPublicKey;
        externalServerKeyShares: ServerKeyShare[];
    }>;
    importRawPrivateKey({ chainName, privateKey, thresholdSignatureScheme, bitcoinConfig, password, backUpToDynamic, onError, onCeremonyComplete, }: {
        chainName: string;
        privateKey: string;
        thresholdSignatureScheme: ThresholdSignatureScheme;
        bitcoinConfig?: BitcoinConfig;
        password?: string;
        backUpToDynamic?: boolean;
        onError?: (error: Error) => void;
        onCeremonyComplete?: (accountAddress: string, walletId: string, shareSetId?: string, shareSetType?: ShareSetType) => void;
    }): Promise<{
        rawPublicKey: RawPublicKey;
        externalServerKeyShares: ServerKeyShare[];
    }>;
    dynamicServerSign({ walletId, message, isFormatted, context, bitcoinConfig, onError, dynamicRequestId: providedRequestId, }: {
        walletId: string;
        message: string | Uint8Array;
        isFormatted?: boolean;
        context?: SignMessageContext;
        bitcoinConfig?: BitcoinConfig;
        onError?: (error: Error) => void;
        dynamicRequestId?: string;
    }): Promise<{
        dynamicRequestId: string;
        roomId: string;
        serverKeygenIds: string[];
    }>;
    externalServerSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted, bitcoinConfig, }: {
        chainName: string;
        message: string | Uint8Array;
        roomId: string;
        keyShare: ServerKeyShare;
        derivationPath: Uint32Array | undefined;
        isFormatted?: boolean;
        bitcoinConfig?: BitcoinConfig;
    }): Promise<Uint8Array | EcdsaSignature>;
    forwardMPCClientSign({ chainName, message, roomId, keyShare, derivationPath, formattedMessage, dynamicRequestId, isFormatted, walletId, }: {
        chainName: string;
        message: string | Uint8Array;
        roomId: string;
        keyShare: ServerKeyShare;
        derivationPath: Uint32Array | undefined;
        formattedMessage: string | Uint8Array | MessageHash;
        dynamicRequestId: string;
        isFormatted?: boolean;
        walletId?: string;
    }): Promise<Uint8Array | EcdsaSignature>;
    /**
     * Attempts forward MPC signing when enabled. Returns the signature on success,
     * or `undefined` when forward MPC is disabled or failed with a recoverable
     * (fallback-eligible) error. Non-fallback-eligible errors are rethrown.
     */
    private trySignViaForwardMpc;
    sign({ accountAddress, externalServerKeyShares, message, chainName, password, isFormatted, context, onError, bitcoinConfig, walletMetadata, walletOperation, passwordPreVerified, }: {
        accountAddress: string;
        externalServerKeyShares?: ServerKeyShare[];
        message: string | Uint8Array;
        chainName: string;
        password?: string;
        isFormatted?: boolean;
        context?: SignMessageContext;
        bitcoinConfig?: BitcoinConfig;
        onError?: (error: Error) => void;
        walletMetadata: WalletMetadata;
        /** Drives recovery shape (e.g. SIGN_MESSAGE vs SIGN_TRANSACTION). */
        walletOperation?: WalletOperation;
        /**
         * BTC pre-resolves shares to derive the public key for BIP-322 / Taproot
         * formatting. When it does, password was already validated by that
         * recovery, so this flag tells `sign()` to skip a second verifyPassword
         * round-trip. Other chains pass shares straight through and don't set it.
         */
        passwordPreVerified?: boolean;
    }): Promise<Uint8Array | EcdsaSignature>;
    refreshWalletAccountShares({ accountAddress, chainName, password, externalServerKeyShares, backUpToDynamic, walletMetadata, }: {
        accountAddress: string;
        chainName: string;
        password?: string;
        externalServerKeyShares?: ServerKeyShare[];
        backUpToDynamic?: boolean;
        walletMetadata: WalletMetadata;
    }): Promise<{
        externalServerKeyShares: (EcdsaKeygenResult | BIP340KeygenResult)[];
        backupInfo: KeyShareBackupInfo;
        walletMetadata: WalletMetadata;
    }>;
    getExportId({ chainName, serverKeyShare, bitcoinConfig, }: {
        chainName: string;
        serverKeyShare: ServerKeyShare;
        bitcoinConfig?: BitcoinConfig;
    }): Promise<string>;
    /**
     * Helper function to create client shares required to complete a reshare ceremony.
     * @param {string} chainName - The chain to create shares for
     * @param {WalletProperties} wallet - The wallet to reshare
     * @param {ThresholdSignatureScheme} oldThresholdSignatureScheme - The current threshold signature scheme
     * @param {ThresholdSignatureScheme} newThresholdSignatureScheme - The target threshold signature scheme
     * @returns {Promise<{
     *   newClientInitKeygenResults: ClientInitKeygenResult[],
     *   newClientKeygenIds: string[],
     *   existingClientKeygenIds: string[],
     *   existingClientKeyShares: ClientKeyShare[]
     * }>} Object containing new and existing client keygen results, IDs and shares
     * @todo Support higher to lower reshare strategies
     */
    reshareStrategy({ chainName, wallet, oldThresholdSignatureScheme, newThresholdSignatureScheme, }: {
        chainName: string;
        wallet: Pick<WalletProperties, 'addressType' | 'externalServerKeyShares'>;
        oldThresholdSignatureScheme: ThresholdSignatureScheme;
        newThresholdSignatureScheme: ThresholdSignatureScheme;
    }): Promise<{
        newExternalServerInitKeygenResults: ServerInitKeygenResult[];
        newExternalServerKeygenIds: string[];
        existingExternalServerKeygenIds: string[];
        existingExternalServerKeyShares: ServerKeyShare[];
    }>;
    reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password, externalServerKeyShares, backUpToDynamic, walletMetadata, }: {
        chainName: string;
        accountAddress: string;
        oldThresholdSignatureScheme: ThresholdSignatureScheme;
        newThresholdSignatureScheme: ThresholdSignatureScheme;
        password?: string;
        externalServerKeyShares?: ServerKeyShare[];
        backUpToDynamic?: boolean;
        walletMetadata: WalletMetadata;
    }): Promise<{
        externalServerKeyShares: (EcdsaKeygenResult | BIP340KeygenResult)[];
        backupInfo: KeyShareBackupInfo;
        walletMetadata: WalletMetadata;
    }>;
    exportKey({ accountAddress, chainName, password, externalServerKeyShares, bitcoinConfig, elevatedAccessToken, walletMetadata, }: RequestWithElevatedAccessToken<{
        accountAddress: string;
        chainName: string;
        password?: string;
        externalServerKeyShares?: ServerKeyShare[];
        bitcoinConfig?: BitcoinConfig;
        walletMetadata: WalletMetadata;
    }>): Promise<{
        derivedPrivateKey: string | undefined;
    }>;
    offlineExportKey({ chainName, keyShares, derivationPath, }: {
        chainName: string;
        keyShares: ServerKeyShare[];
        derivationPath?: string;
    }): Promise<{
        derivedPrivateKey: string | undefined;
    }>;
    encryptKeyShare({ keyShare, password }: {
        keyShare: ServerKeyShare;
        password?: string;
    }): Promise<string>;
    storeEncryptedBackupByWallet({ accountAddress, externalServerKeyShares, password, backUpToDynamic, walletMetadata, shareSetId, }: {
        accountAddress: string;
        externalServerKeyShares?: ServerKeyShare[];
        password?: string;
        backUpToDynamic: boolean;
        walletMetadata: WalletMetadata;
        shareSetId?: string;
    }): Promise<{
        keySharesWithBackupStatus: {
            share: ServerKeyShare;
            backedUpToClientKeyShareService: boolean;
        }[];
        backupInfo: KeyShareBackupInfo;
    }>;
    storeEncryptedBackupByWalletWithRetry({ accountAddress, externalServerKeyShares, password, backUpToDynamic, walletMetadata, }: {
        accountAddress: string;
        externalServerKeyShares?: ServerKeyShare[];
        password?: string;
        backUpToDynamic: boolean;
        walletMetadata: WalletMetadata;
    }): Promise<{
        keySharesWithBackupStatus: Array<{
            share: ServerKeyShare;
            backedUpToClientKeyShareService: boolean;
        }>;
        backupInfo: KeyShareBackupInfo;
    }>;
    getExternalServerKeyShares({ accountAddress, password, walletMetadata, backupInfo, }: {
        accountAddress: string;
        password?: string;
        walletMetadata: WalletMetadata;
        backupInfo?: KeyShareBackupInfo;
    }): Promise<any[]>;
    updatePassword({ accountAddress, existingPassword, newPassword, backUpToDynamic, externalServerKeyShares, walletMetadata, }: {
        accountAddress: string;
        existingPassword?: string;
        newPassword?: string;
        backUpToDynamic: boolean;
        externalServerKeyShares?: ServerKeyShare[];
        walletMetadata: WalletMetadata;
    }): Promise<{
        backupInfo: KeyShareBackupInfo;
    }>;
    decryptKeyShare({ keyShare, password }: {
        keyShare: string;
        password?: string;
    }): Promise<ServerKeyShare>;
    /**
     * Helper function to determine keyshare recovery strategy for dynamic shares.
     * For REFRESH operations, retrieves enough shares to meet the client threshold.
     * For all other operations, retrieves just 1 share.
     *
     * @param clientKeyShareBackupInfo - Information about backed up key shares
     * @param thresholdSignatureScheme - The signature scheme being used (2-of-2, 2-of-3, etc)
     * @param walletOperation - The operation being performed (REFRESH, SIGN_MESSAGE, etc)
     * @param shareCount - The number of shares to recover if specified for reshare operations
     * @returns @shares: Object mapping backup locations to arrays of share IDs to recover
     * @returns @requiredShareCount: The number of shares required to recover
     */
    recoverStrategy({ externalServerKeySharesBackupInfo, thresholdSignatureScheme, walletOperation, shareCount, }: {
        externalServerKeySharesBackupInfo: KeyShareBackupInfo;
        thresholdSignatureScheme: ThresholdSignatureScheme;
        walletOperation: WalletOperation;
        shareCount?: number;
    }): {
        shares: Partial<Record<BackupLocation, string[]>>;
        requiredShareCount: number;
    };
    /**
     * Resolves and returns key shares for wallet operations.
     * Checks in order: provided shares, then attempts recovery from backup.
     * @param accountAddress - The account address to get shares for
     * @param password - The password to decrypt the shares
     * @param walletOperation - The wallet operation being performed
     * @param externalServerKeyShares - The provided key shares (if any)
     * @param errorMessage - The error message to throw if no shares are found
     * @param walletMetadata - Required wallet metadata identifying the target wallet
     * @returns The resolved key shares
     * @throws Error if no shares are found and recovery fails
     */
    protected resolveKeyShares({ accountAddress, password, walletOperation, externalServerKeyShares, errorMessage, walletMetadata, backupInfo, }: {
        accountAddress: string;
        password?: string;
        walletOperation: WalletOperation;
        externalServerKeyShares?: ServerKeyShare[];
        errorMessage: string;
        walletMetadata: WalletMetadata;
        backupInfo?: KeyShareBackupInfo;
    }): Promise<ServerKeyShare[]>;
    recoverEncryptedBackupByWallet({ accountAddress, password, walletOperation, shareCount, walletMetadata, backupInfo, }: {
        accountAddress: string;
        password?: string;
        walletOperation: WalletOperation;
        shareCount?: number;
        walletMetadata: WalletMetadata;
        backupInfo?: KeyShareBackupInfo;
    }): Promise<any[]>;
    exportExternalServerKeyShares({ accountAddress, password, walletMetadata, }: {
        accountAddress: string;
        password?: string;
        walletMetadata: WalletMetadata;
    }): Promise<any[]>;
    /**
     * verifyPassword attempts to recover and decrypt a single client key share using the provided password.
     * If successful, the key share is encrypted with the new password. This method solely performs the recovery
     * and decryption without storing the restored key shares. If unsuccessful, it throws an error.
     */
    verifyPassword({ accountAddress, password, walletMetadata, backupInfo, }: {
        accountAddress: string;
        password?: string;
        walletMetadata: WalletMetadata;
        backupInfo?: KeyShareBackupInfo;
    }): Promise<void>;
    isPasswordEncrypted({ accountAddress, walletMetadata, backupInfo, }: {
        accountAddress: string;
        walletMetadata: WalletMetadata;
        backupInfo?: KeyShareBackupInfo;
    }): Promise<boolean>;
    /**
     * check if the operation requires a password
     */
    requiresPasswordForOperation({ accountAddress, walletOperation, walletMetadata, backupInfo, }: {
        accountAddress: string;
        walletOperation?: WalletOperation;
        walletMetadata: WalletMetadata;
        backupInfo?: KeyShareBackupInfo;
    }): Promise<boolean>;
    /**
     * check if the operation requires restoring backup shares
     */
    requiresRestoreBackupSharesForOperation({ accountAddress, walletOperation, walletMetadata, backupInfo, }: {
        accountAddress: string;
        walletOperation?: WalletOperation;
        walletMetadata: WalletMetadata;
        backupInfo?: KeyShareBackupInfo;
    }): Promise<boolean>;
    getWalletExternalServerKeyShareBackupInfo({ walletMetadata, }: {
        walletMetadata: WalletMetadata;
    }): Promise<KeyShareBackupInfo>;
    /**
     * Get a single wallet by address.
     * First tries the efficient `getWaasWalletByAddress` endpoint, falls back to
     * `getUser()` if not available.
     *
     * Note: the `getWaasWalletByAddress` endpoint returns wallet identity only
     * — it does not include keyShare pointer metadata, so the byAddress path
     * leaves `externalServerKeySharesBackupInfo` `undefined`. Operations that
     * need it (sign with auto-recovery, password verification, refresh,
     * reshare, updatePassword) will throw on a result obtained via this path.
     * The `getUser()` fallback populates `externalServerKeySharesBackupInfo`
     * from `walletProperties.keyShares`.
     *
     * Prefer `fetchWalletMetadata(accountAddress)` for identity-only lookups.
     */
    getWalletByAddress(accountAddress: string): Promise<WalletProperties | null>;
    /**
     * Get all wallets (kept for backward compatibility but now uses lazy loading)
     * @deprecated Consider using getWalletByAddress for better performance with large wallet counts
     */
    getWallets(): Promise<{
        walletId: string;
        chainName: string;
        accountAddress: string;
        externalServerKeySharesBackupInfo: KeyShareBackupInfo;
        externalServerKeyShares: never[];
        derivationPath: string | undefined;
        thresholdSignatureScheme: ThresholdSignatureScheme;
    }[]>;
}
export {};
//# sourceMappingURL=client.d.ts.map