/**
 * Auth Resource
 *
 * Handles authentication with the privacy system.
 */
import type { ResolvedPrivacyBoostConfig } from '../core/types';
import type { AuthResult } from '../types';
import type { AuthenticateOptions } from '../core/types';
import type { SDKStores } from '../state/stores';
import type { KeyVault } from '../keyvault/types';
import type { AuthClient } from '../api/auth-client';
import type { Logger } from '../utils/logger';
import type { SessionRestoredEvent, SessionExpiredEvent } from '../types/resources';
export type { SessionRestoredEvent, SessionExpiredEvent } from '../types/resources';
/**
 * Login payload computed by the SDK.
 * Passed to the token provider callback so the integrator can forward it
 * to their own server or use it directly.
 */
export interface LoginPayload {
    appId: string;
    mpk: string;
    viewauthSignature: string;
    nonce: string;
    accountId: string;
    viewingPublicKey: {
        x: string;
        y: string;
    };
    nullifyingKey: string;
    walletAddress: string;
    authPkX: string;
    authPkY: string;
    authExpiry: number;
    authSignature: string;
}
/**
 * Token provider function type.
 * Receives the login payload and returns a token + expiry.
 */
export type TokenProvider = (payload: LoginPayload) => Promise<{
    token: string;
    expiresIn: number;
}>;
/**
 * Bridge interface between a wallet and the WASM authentication layer.
 *
 * This is distinct from the `WalletAdapter` in `lib/wallet/types.ts` which
 * handles wallet provider connection (EIP-1193). This interface provides
 * the signing and transaction primitives that the WASM SDK needs during
 * authentication and vault operations.
 */
export interface AuthWalletBridge {
    connect(): Promise<{
        address: string;
        chainId: number;
    }>;
    disconnect(): Promise<void>;
    signMessage(message: string): Promise<string>;
    signTypedData(typedData: string): Promise<string>;
    sendTransaction(tx: unknown): Promise<string>;
    getAddress(): Promise<string>;
    getChainId(): Promise<number>;
    /**
     * Subscribe to wallet account changes. Returns an unsubscribe function.
     * When accounts change, protocol keys become invalid and re-auth is required.
     */
    onAccountsChanged?(handler: (accounts: string[]) => void): () => void;
    /**
     * Subscribe to wallet chain/network changes. Returns an unsubscribe function.
     */
    onChainChanged?(handler: (chainId: number) => void): () => void;
}
export declare class AuthResource {
    private config;
    private walletBridge;
    private onLoginComplete;
    private onJwtUpdate;
    private stores;
    private keyVault;
    private authClient;
    private log;
    private _updatePublicClient;
    private eventCleanups;
    private _onAccountChange;
    private _onChainChange;
    private _onSessionRestored;
    private _onSessionExpired;
    private _skipAcquireJwt;
    constructor(config: ResolvedPrivacyBoostConfig, stores: SDKStores, keyVault: KeyVault, authClient?: AuthClient | null, logger?: Logger);
    private get walletStore();
    private setClientJwt;
    private wrapTokenProvider;
    /**
     * Set a callback to be called after successful login.
     * Used by PrivacyBoost to trigger balance sync.
     * @internal
     */
    setOnLoginComplete(callback: () => Promise<void>): void;
    /**
     * Set a callback to propagate JWT tokens to the parent SDK.
     * Called after successful wallet login so IndexerClient/AuthClient
     * can make authenticated HTTP requests.
     * @internal
     */
    setOnJwtUpdate(callback: (token: string | null) => void): void;
    /**
     * Switch the public client used by the wallet proxy's
     * `waitForTransactionReceipt` to point at the given chain.
     *
     * Must be called before performing vault operations on a different
     * chain than the one used during initial `authenticate()`.
     */
    switchReceiptChain(chainId: number, rpcUrl?: string): void;
    /**
     * Set a callback for when the wallet account changes.
     * The handler receives the new list of accounts (empty = disconnected).
     * By default, AuthResource clears auth state and calls this handler.
     */
    /**
     * Skip parent-side JWT acquisition. In iframe mode, the WASM inside the
     * iframe manages its own JWT. The proxy routes requests through the iframe
     * which adds auth automatically, so the parent doesn't need its own JWT.
     * @internal
     */
    setSkipAcquireJwt(skip: boolean): void;
    /** @internal */
    setOnAccountChange(handler: (accounts: string[]) => void): void;
    /**
     * Set a callback for when the wallet chain changes.
     * @internal
     */
    setOnChainChange(handler: (chainId: number) => void): void;
    /** @internal */
    setOnSessionRestored(handler: (event: SessionRestoredEvent) => void): void;
    /** @internal */
    setOnSessionExpired(handler: (event: SessionExpiredEvent) => void): void;
    /**
     * Subscribe to wallet provider events after authentication.
     * On account change: clears auth state (protocol keys are wallet-specific).
     * On chain change: notifies via callback for upstream handling.
     */
    private subscribeToWalletEvents;
    private cleanupEventSubscriptions;
    /**
     * Logout: end session completely, clear all state.
     * After this, the user must re-authenticate from scratch.
     */
    logout(): Promise<void>;
    /**
     * Authenticate with the privacy system using a two-phase pattern.
     *
     * This is the recommended way to authenticate. It handles wallet connection,
     * key derivation, and server login in a single call.
     *
     * Returns either:
     * - `{ status: "authenticated", privacyAddress, mpk }` — fully authenticated
     * - `{ status: "credentialRequired", action, unlockType, submit }` — a PIN or password is needed
     * - `{ status: "recoveryRequired", reason, recover }` — vault is corrupted, needs mnemonic recovery
     *
     * When `credentialRequired` is returned, call `result.submit(credential)` to complete authentication.
     *
     * @param adapter - Wallet bridge implementation (see {@link AuthWalletBridge})
     * @param keySource - Optional key source for key derivation (mnemonic, rawSeed, or walletDerived)
     * @param tokenProvider - Optional callback to obtain a JWT from the login payload
     * @returns AuthResult discriminated union
     *
     * @example
     * ```typescript
     * const result = await sdk.auth.authenticate(walletBridge);
     *
     * if (result.status === 'authenticated') {
     *   console.log('Logged in:', result.privacyAddress);
     * } else {
     *   // Prompt user for PIN/password
     *   const pin = await promptUser(result.action, result.unlockType);
     *   const authenticated = await result.submit(pin);
     *   console.log('Logged in:', authenticated.privacyAddress);
     * }
     * ```
     */
    authenticate(adapter: AuthWalletBridge, options?: AuthenticateOptions): Promise<AuthResult>;
    private buildRecoveryClosure;
    /**
     * Acquire a JWT for the TypeScript-side HTTP clients by performing
     * a wallet login + optional privacy-key upgrade via AuthClient.
     * This runs independently of the KeyVault auth flow.
     */
    private acquireJwt;
    /**
     * Clear session: clear JWT only, keep keys for quick re-auth.
     */
    clearSession(): Promise<void>;
    /**
     * Get the current wallet bridge (for internal use by other resources).
     * Returns null if no wallet is connected.
     * @internal
     */
    getWalletBridge(): AuthWalletBridge | null;
    /**
     * Check if wallet is connected.
     * Uses the wallet store rather than wasm.isConnected because in iframe
     * mode the parent's WASM instance does not track wallet state.
     */
    isConnected(): boolean;
    /**
     * Check if user is authenticated
     */
    isAuthenticated(): boolean;
    /**
     * Get the user's privacy address
     */
    getPrivacyAddress(): string | null;
    /**
     * Get the user's MPK (master public key)
     */
    getMpk(): string | null;
    /**
     * Permanently delete the server vault and clear local state.
     * Requires wallet signature for ownership proof.
     */
    deleteVault(): Promise<void>;
    /**
     * Get session info from the server.
     */
    getSessionInfo(): Promise<{
        mpk: string;
        isAuditor: boolean;
        valid: boolean;
        expiresAt: number;
    } | null>;
    /**
     * Clean up event subscriptions without a full logout.
     * Called by PrivacyBoost.dispose() to prevent leaked listeners.
     */
    dispose(): void;
}
//# sourceMappingURL=Auth.d.ts.map