/**
 * NOTE: Added reference types here to avoid a `pnpm` bug during build.
 * https://github.com/enboxorg/enbox/pull/507
 */
import type { EnboxPlatformAgent } from '@enbox/agent';
import type { ProtocolDefinition } from '@enbox/dwn-sdk-js';
import type { EnboxAnonymousApi, EnboxAnonymousOptions, EnboxConnectOptions, EnboxConnectResult, EnboxParams, EnboxSessionParams } from './enbox-types.js';
import type { SchemaMap, TypedProtocol } from './protocol-types.js';
import { DidApi } from './did-api.js';
import { TypedEnbox } from './typed-enbox.js';
import { VcApi } from './vc-api.js';
/**
 * The main Enbox API interface. It provides protocol-scoped access to
 * Decentralized Web Nodes (DWNs), Decentralized Identifiers (DIDs),
 * and Verifiable Credentials (VCs).
 *
 * For common app flows, use the asynchronous {@link Enbox.connect} helper.
 * For custom auth/session flows, use {@link Enbox.fromSession} with an
 * existing session, or the public constructor with raw `{ agent, connectedDid }`.
 *
 * @example
 * ```ts
 * import { Enbox } from '@enbox/api';
 *
 * const { enbox } = await Enbox.connect({
 *   createIdentity: true,
 *   sync: '15s',
 * });
 *
 * const social = enbox.using(SocialProtocol);
 * ```
 */
export declare class Enbox {
    /**
     * The {@link EnboxPlatformAgent} this instance is bound to. The platform
     * agent handles DIDs, DWN access, signing keys, and DWN sync — every
     * Enbox session needs all of those, so the type is narrower than the
     * minimal {@link EnboxAgent} interface and the constructor refuses
     * non-platform agents at compile time.
     */
    agent: EnboxPlatformAgent;
    /** Exposed instance to the DID APIs, allow users to create and resolve DIDs. */
    did: DidApi;
    /** Internal DWN API instance. Use {@link Enbox.using} for protocol-scoped access. */
    private readonly _dwn;
    /**
     * Cache of {@link TypedEnbox} instances keyed by protocol URI.
     *
     * Ensures that `enbox.using(Protocol)` returns the **same** `TypedEnbox`
     * instance for a given protocol across multiple call sites, avoiding
     * redundant protocol installations and duplicated internal state.
     */
    private readonly _typedInstances;
    /** Exposed instance to the VC APIs, allow users to issue, present and verify VCs. */
    vc: VcApi;
    /**
     * The `AuthManager` this instance owns and is responsible for tearing down
     * during {@link Enbox.disconnect}. Set only by the async
     * {@link Enbox.connect} factory; never populated by the public constructor
     * or {@link Enbox.fromSession}.
     */
    private _ownedAuth?;
    /**
     * Memoized teardown promise. Two parallel `enbox.disconnect()` calls
     * share the same promise so `agent.sync.stopSync()` (and the optional
     * `auth.shutdown()`) run exactly once even when callers fire the
     * teardown from independent code paths.
     */
    private _disconnecting?;
    constructor({ agent, connectedDid, delegateDid }: EnboxParams);
    /**
     * Returns a {@link TypedEnbox} instance scoped to the given protocol.
     *
     * This is the **primary developer interface** for interacting with
     * protocol-backed records. It auto-injects the protocol URI, protocolPath,
     * and schema into every operation, and provides compile-time path
     * autocompletion plus typed data payloads via the schema map.
     *
     * Instances are **cached by protocol URI** — calling `using()` multiple
     * times with the same protocol returns the same `TypedEnbox` instance,
     * so auto-configure only runs once and all call sites share state.
     *
     * @param protocol - A typed protocol created via `defineProtocol()`.
     * @returns A `TypedEnbox` instance bound to the given protocol.
     *
     * @example
     * ```ts
     * const social = enbox.using(SocialProtocol);
     *
     * await social.configure();
     *
     * const { record } = await social.records.write('friend', {
     *   data: { did: 'did:example:alice', alias: 'Alice' },
     * });
     *
     * const { records } = await social.records.query('friend');
     * ```
     */
    using<D extends ProtocolDefinition, M extends SchemaMap>(protocol: TypedProtocol<D, M>): TypedEnbox<D, M>;
    /**
     * Signs the user out and releases resources held by this Enbox instance.
     *
     * When this instance owns the underlying `AuthManager` (i.e. it was
     * created via `Enbox.connect()` with no caller-supplied `agent`), the
     * disconnect proceeds in three phases:
     *
     *   1. **Stop sync** — `agent.sync.stopSync(timeout)` halts the DWN
     *      sync engine. Always runs, regardless of ownership.
     *   2. **Sign out** — `AuthManager.disconnect()` sends delegate-grant
     *      revocations to the connected DWN endpoints, clears session
     *      restore markers (PREVIOUSLY_CONNECTED, ACTIVE_IDENTITY,
     *      delegate keys, etc.) from the StorageAdapter, and clears the
     *      in-memory delegate decryption key cache. **Without this step
     *      a later `Enbox.connect()` would silently restore the
     *      supposedly signed-out session from the persisted markers.**
     *   3. **Release resources** — `AuthManager.shutdown()` locks the
     *      vault, closes the sync engine, and closes the StorageAdapter.
     *
     * When the instance was created from a caller-owned session
     * ({@link Enbox.fromSession}), a raw agent (the public constructor),
     * or `Enbox.connect({ agent })`, only step 1 (stop sync) runs — the
     * caller's AuthManager / agent keep their lifecycle. The caller is
     * responsible for calling `auth.disconnect()` and `auth.shutdown()`
     * on their own handle when they're done.
     *
     * Idempotent: parallel calls share the same teardown promise. After
     * calling `disconnect()`, the `Enbox` instance should not be reused.
     *
     * @param timeout - Maximum milliseconds to wait for an in-progress sync
     *   cycle to finish before force-stopping. Defaults to `2000`.
     *
     * @example
     * ```ts
     * // High-level flow: a single disconnect() does sign-out + teardown.
     * const { enbox } = await Enbox.connect({ createIdentity: true });
     * // ... user uses the app ...
     * await enbox.disconnect();   // revoke grants, clear markers, close vault
     *
     * // Caller-owned auth: enbox.disconnect() only stops Enbox-side state.
     * const auth = await AuthManager.create({...});
     * const session = await auth.connectVault({ createIdentity: true });
     * const enbox = Enbox.fromSession(session);
     * await enbox.disconnect();   // stops sync + clears typed-enbox cache
     * await auth.disconnect();    // sign-out: caller's responsibility
     * await auth.shutdown();      // close resources: caller's responsibility
     * ```
     *
     * @beta
     */
    disconnect(timeout?: number): Promise<void>;
    private _doDisconnect;
    /**
     * Creates a lightweight, read-only Enbox instance for querying public DWN data.
     *
     * No identity, vault, password, or signing keys are required. The returned
     * API supports querying and reading published records and protocols from any
     * remote DWN, using **unsigned** (anonymous) DWN messages.
     *
     * @param options - Optional configuration overrides.
     * @returns An {@link EnboxAnonymousApi} with a read-only `dwn` property.
     *
     * @example
     * ```ts
     * const { dwn } = Enbox.anonymous();
     *
     * const { records } = await dwn.records.query({
     *   from: 'did:dht:alice...',
     *   filter: { protocol: 'https://social.example/posts', protocolPath: 'post' },
     * });
     *
     * for (const record of records) {
     *   console.log(record.id, await record.data.text());
     * }
     * ```
     *
     * @beta
     */
    static anonymous(options?: EnboxAnonymousOptions): EnboxAnonymousApi;
    /**
     * Creates an {@link Enbox} instance from a session-shaped object.
     *
     * Accepts `AuthSession`, `AgentSession`, or any compatible custom session
     * with `{ agent, did, delegateDid? }`. This is the right entry point
     * whenever you already hold an active session — including ones produced by
     * a caller-managed `AuthManager`.
     *
     * For raw `{ agent, connectedDid }` access (no session shape), use the
     * public constructor directly: `new Enbox({ agent, connectedDid })`.
     */
    static fromSession(session: EnboxSessionParams): Enbox;
    /**
     * High-level entry point that creates an {@link AuthManager}, runs
     * `auth.connect()`, and returns the resulting `{ auth, session, enbox }`.
     *
     * For callers that already own an agent and DID, use the dedicated
     * synchronous entry points instead:
     * - `new Enbox({ agent, connectedDid })` for raw parameters
     * - {@link Enbox.fromSession} for session-shaped objects
     *
     * Routing happens at runtime inside `AuthManager.connect`: a recovery phrase
     * is treated as an explicit vault-restore action; otherwise, a non-empty
     * `protocols` array or a `connectHandler` selects the handler flow and
     * everything else routes to local. Local-style fields (`password`,
     * `dwnEndpoints`, etc.) are forwarded to both the manager (as defaults) and
     * the per-call payload, so behavior is consistent with restored sessions.
     *
     * If you need exact control of the `AuthManager.connect()` payload,
     * drop down one layer: create the `AuthManager` yourself with
     * `AuthManager.create()`, call `auth.connect(...)` with your exact
     * options, and pass the resulting session to `Enbox.fromSession`.
     *
     * @example
     * ```ts
     * const { enbox, session, auth } = await Enbox.connect({ createIdentity: true });
     * // ...
     * await enbox.disconnect();
     * await auth.shutdown(); // release vault + storage handles
     * ```
     */
    static connect(options?: EnboxConnectOptions): Promise<EnboxConnectResult>;
    /**
     * Split `EnboxConnectOptions` into the manager-wide defaults that
     * `AuthManager.create()` consumes.
     *
     * Implemented as an **explicit allowlist** for the same reason as
     * `toAuthConnectOptions`: a denylist would silently leak future
     * `HandlerConnectOptions` / `VaultConnectOptions` fields into the
     * manager-default record. The `satisfies Partial<AuthManagerOptions>`
     * annotation makes the compiler verify every key in the allowlist
     * exists on `AuthManagerOptions`, so a misspelled or stale field name
     * is a type error.
     */
    private static toAuthManagerOptions;
    /**
     * Split `EnboxConnectOptions` into the per-call payload that
     * `AuthManager.connect()` consumes.
     *
     * Implemented as an **explicit allowlist** of the fields declared on
     * {@link HandlerConnectOptions} ∪ {@link VaultConnectOptions}. A
     * denylist (strip manager-only fields, forward the rest) would
     * silently leak any future `AuthManagerOptions` field into
     * `AuthManager.connect()`; the allowlist makes the type boundary
     * explicit and the leak impossible. The trade-off is symmetric:
     * any new connect-options field requires an edit here. That's
     * acceptable — it's the same edit the public `ConnectOptions` type
     * already needs, just on one extra line.
     *
     * The `satisfies Partial<ConnectOptions>` annotation makes the
     * compiler verify every key in the allowlist exists on `ConnectOptions`,
     * so misspelling a field name is a type error rather than a silent
     * drop. Routing between restore, local, and handler flow happens inside
     * `AuthManager.connect`.
     *
     * `protocols: []` is normalized away — an empty array carries no
     * permission intent and would otherwise produce a zero-grant
     * "connected" handler session indistinguishable from a denied connect.
     */
    private static toAuthConnectOptions;
}
//# sourceMappingURL=enbox.d.ts.map