/**
 * Wallet Authentication Module
 *
 * Handles wallet connection and license validation via Optimism NFT.
 * Works with any EIP-1193 compatible wallet (MetaMask, WalletConnect, etc.)
 */

/**
 * EIP-1193 Provider interface (MetaMask, etc.)
 */
interface EIP1193Provider {
    request(args: {
        method: string;
        params?: unknown[];
    }): Promise<unknown>;
    on(event: string, listener: (...args: unknown[]) => void): void;
    removeListener(event: string, listener: (...args: unknown[]) => void): void;
}
/**
 * Wallet connection state
 */
interface WalletState {
    connected: boolean;
    address: string | null;
    chainId: number | null;
    isOptimism: boolean;
}
/**
 * License NFT metadata
 */
interface LicenseNFT {
    tokenId: string;
    tier: 'starter' | 'pro' | 'enterprise';
    expiry: number;
    capabilities: string[];
}
/**
 * Wallet Authentication Client
 */
declare class WalletAuth {
    private provider;
    private state;
    private oracleEndpoint;
    constructor(oracleEndpoint?: string);
    /**
     * Connect to wallet and validate license
     */
    connect(provider?: EIP1193Provider): Promise<AuthSession>;
    /**
     * Disconnect wallet
     */
    disconnect(): void;
    /**
     * Get current wallet state
     */
    getState(): WalletState;
    /**
     * Check if connected
     */
    isConnected(): boolean;
    /**
     * Get connected address
     */
    getAddress(): string | null;
    /**
     * Switch to Optimism network
     */
    private switchToOptimism;
    /**
     * Validate license via oracle
     */
    private validateLicense;
    /**
     * Sign a message with the connected wallet
     */
    private signMessage;
    /**
     * Get window.ethereum provider
     */
    private getWindowProvider;
    /**
     * Set up wallet event listeners
     */
    private setupEventListeners;
}
/**
 * Check if a wallet has a valid license NFT
 * (Direct contract call without oracle, for display purposes)
 */
declare function checkLicenseNFT(provider: EIP1193Provider, address: string): Promise<LicenseNFT | null>;
/**
 * Create a new WalletAuth instance
 */
declare function createWalletAuth(oracleEndpoint?: string): WalletAuth;

/**
 * Oracle Service Interface
 *
 * Defines the interface for the license validation oracle.
 * The oracle verifies wallet signatures and checks on-chain license NFTs.
 */

/**
 * Oracle configuration
 */
interface OracleConfig {
    endpoint: string;
    timeout?: number;
    retryCount?: number;
}
/**
 * Challenge request
 */
interface ChallengeRequest {
    address: string;
}
/**
 * Challenge response from oracle
 */
interface ChallengeResponse {
    challenge: string;
    expiresAt: number;
    nonce: string;
}
/**
 * Verification request
 */
interface VerifyRequest {
    address: string;
    challenge: string;
    signature: string;
    nonce: string;
}
/**
 * Verification response
 */
interface VerifyResponse {
    valid: boolean;
    jwt?: string;
    session?: AuthSession;
    error?: string;
    licenseInfo?: LicenseInfo;
}
/**
 * License information from on-chain
 */
interface LicenseInfo {
    tokenId: string;
    tier: number;
    expiry: number;
    capabilities: string[];
    transferable: boolean;
}
/**
 * Streaming authorization
 */
interface StreamingAuth {
    token: string;
    expiresAt: number;
    allowedFunctions: string[];
    rateLimit: number;
}
/**
 * Oracle service interface
 */
interface IOracleService {
    /**
     * Request a challenge for wallet signature
     */
    getChallenge(address: string): Promise<ChallengeResponse>;
    /**
     * Verify wallet signature and return session
     */
    verify(request: VerifyRequest): Promise<VerifyResponse>;
    /**
     * Refresh an existing session
     */
    refresh(sessionId: string): Promise<VerifyResponse>;
    /**
     * Revoke a session
     */
    revoke(sessionId: string): Promise<void>;
    /**
     * Get streaming authorization for CLI
     */
    getStreamingAuth(sessionId: string, functions: string[]): Promise<StreamingAuth>;
    /**
     * Check license status without full verification
     */
    checkLicense(address: string): Promise<LicenseInfo | null>;
}
/**
 * Oracle client implementation
 */
declare class OracleClient implements IOracleService {
    private config;
    constructor(config: OracleConfig);
    getChallenge(address: string): Promise<ChallengeResponse>;
    verify(request: VerifyRequest): Promise<VerifyResponse>;
    refresh(sessionId: string): Promise<VerifyResponse>;
    revoke(sessionId: string): Promise<void>;
    getStreamingAuth(sessionId: string, functions: string[]): Promise<StreamingAuth>;
    checkLicense(address: string): Promise<LicenseInfo | null>;
    private fetch;
}
/**
 * Mock oracle for testing
 */
declare class MockOracleClient implements IOracleService {
    private sessions;
    private challenges;
    getChallenge(address: string): Promise<ChallengeResponse>;
    verify(request: VerifyRequest): Promise<VerifyResponse>;
    refresh(sessionId: string): Promise<VerifyResponse>;
    revoke(sessionId: string): Promise<void>;
    getStreamingAuth(sessionId: string, functions: string[]): Promise<StreamingAuth>;
    checkLicense(address: string): Promise<LicenseInfo | null>;
}
/**
 * Create an oracle client
 */
declare function createOracleClient(config: OracleConfig): IOracleService;
/**
 * Create a mock oracle client for testing
 */
declare function createMockOracleClient(): IOracleService;

/**
 * Zero-Knowledge Secret Encryption for Edgework SDK
 *
 * Implements ECIES (Elliptic Curve Integrated Encryption Scheme) for
 * zero-knowledge API key handling. Users encrypt their API keys client-side
 * using Cog's public key - the platform never sees plaintext secrets.
 *
 * Encryption flow:
 * 1. Fetch Cog's P-256 public key from gateway
 * 2. Generate ephemeral ECDH key pair (forward secrecy)
 * 3. Derive shared secret via ECDH
 * 4. Derive AES-256 key from shared secret using HKDF
 * 5. Encrypt API key with AES-256-GCM
 * 6. Return encrypted blob for UCAN fct field
 *
 * @security Forward secrecy via ephemeral keys per encryption
 * @security Replay protection via nonce and timestamp
 * @security Time-boxed by UCAN expiration
 */
/**
 * Supported paid API providers
 */
type PaidApiProvider = 'openai' | 'anthropic' | 'gemini' | 'groq';
/**
 * Cog public key information
 */
interface CogPublicKeyInfo {
    keyId: string;
    publicKey: JsonWebKey;
    expiresAt: number;
    endpoint: string;
}
/**
 * Encrypted secret structure for UCAN fct field
 */
interface EncryptedSecretFact {
    alg: 'ECIES-P256';
    epk: string;
    ct: string;
    iv: string;
    tag: string;
    cogKeyId: string;
    provider: PaidApiProvider;
    nonce: string;
    encryptedAt: number;
}
/**
 * Options for secret encryption
 */
interface SecretEncryptionOptions {
    /** Mesh gateway endpoint (default: https://mesh.affectively.ai) */
    gatewayEndpoint?: string;
    /** Override public key (for testing) */
    cogPublicKey?: CogPublicKeyInfo;
    /** Cache TTL for public key in ms (default: 1 hour) */
    publicKeyCacheTtl?: number;
}
/**
 * Options for creating a paid API UCAN
 */
interface PaidApiUCANOptions extends SecretEncryptionOptions {
    /** Expiration in seconds (default: 3600 = 1 hour, max: 604800 = 7 days) */
    expirationSeconds?: number;
    /** Maximum cost in cents per request */
    maxCostCentsPerRequest?: number;
    /** Maximum cost in cents per day */
    maxCostCentsPerDay?: number;
    /** Allowed models (empty = all allowed) */
    allowedModels?: string[];
}
/**
 * Fetch Cog's public key from mesh gateway
 *
 * The public key is cached for 1 hour by default.
 *
 * @param gatewayEndpoint - Gateway URL
 * @param cacheTtl - Cache TTL in ms
 * @returns Cog's public key info
 */
declare function fetchCogPublicKey(gatewayEndpoint?: string, cacheTtl?: number): Promise<CogPublicKeyInfo>;
/**
 * Clear the cached public key (useful for testing or key rotation)
 */
declare function clearPublicKeyCache(): void;
/**
 * Encrypt an API secret for zero-knowledge transmission
 *
 * Uses ECIES (Elliptic Curve Integrated Encryption Scheme):
 * 1. Generate ephemeral ECDH key pair
 * 2. Compute shared secret with Cog's public key
 * 3. Derive AES-256 key using HKDF
 * 4. Encrypt API key with AES-256-GCM
 *
 * @param apiKey - The API key to encrypt (plaintext)
 * @param provider - API provider (openai, anthropic, etc.)
 * @param options - Encryption options
 * @returns Encrypted secret fact for UCAN
 *
 * @security The apiKey parameter is used only for encryption and not stored
 * @security Ephemeral keys provide forward secrecy
 */
declare function encryptApiSecret(apiKey: string, provider: PaidApiProvider, options?: SecretEncryptionOptions): Promise<EncryptedSecretFact>;
/**
 * Create a UCAN token with an encrypted API secret
 *
 * This is the main function for zero-knowledge API delegation.
 * The resulting UCAN can be used to make paid API requests through
 * the paid-ai-proxy without exposing the API key.
 *
 * @param userId - User ID (issuer)
 * @param apiKey - The API key to encrypt and embed
 * @param provider - API provider
 * @param options - UCAN options
 * @returns UCAN token string (JWT-like format)
 *
 * @example
 * ```typescript
 * const ucan = await createPaidApiUCAN(
 *   'user-123',
 *   'sk-abc123...',  // Your OpenAI key (encrypted, never sent in plaintext)
 *   'openai',
 *   { expirationSeconds: 3600 }
 * );
 *
 * // Use in request
 * fetch('https://paid-ai-proxy.affectively.ai/v1/chat/completions', {
 *   headers: { 'Authorization': `Bearer ${ucan}` }
 * });
 * ```
 */
declare function createPaidApiUCAN(userId: string, apiKey: string, provider: PaidApiProvider, options?: PaidApiUCANOptions): Promise<string>;
/**
 * Check if an encrypted secret fact is valid (not expired, correct format)
 *
 * @param fact - The encrypted secret fact to validate
 * @param maxAgeMs - Maximum age in milliseconds (default: 5 minutes)
 * @returns true if valid
 */
declare function isValidEncryptedSecret(fact: EncryptedSecretFact, maxAgeMs?: number): boolean;
/**
 * Extract encrypted secret from a UCAN token
 *
 * @param tokenString - UCAN token string
 * @returns Encrypted secret fact or null if not found
 */
declare function extractEncryptedSecret(tokenString: string): EncryptedSecretFact | null;

/**
 * Edgework Auth Module
 *
 * Provides authentication and authorization services:
 * - Wallet-based auth (Optimism NFT licenses)
 * - UCAN-based auth (legacy)
 * - Oracle service for license validation
 */
interface AuthSession {
    token: string;
    identity: string;
    capabilities: string[];
}

interface AuthService {
    getSession(): Promise<AuthSession | null>;
    login(token: string): Promise<void>;
    logout(): Promise<void>;
}
declare class EdgeworkAuth implements AuthService {
    private session;
    getSession(): Promise<AuthSession | null>;
    login(token: string): Promise<void>;
    logout(): Promise<void>;
    /**
     * Verify UCAN token structure and core claims defensively.
     */
    private verifyUCANToken;
}

type index_AuthService = AuthService;
type index_AuthSession = AuthSession;
type index_ChallengeRequest = ChallengeRequest;
type index_ChallengeResponse = ChallengeResponse;
type index_CogPublicKeyInfo = CogPublicKeyInfo;
type index_EIP1193Provider = EIP1193Provider;
type index_EdgeworkAuth = EdgeworkAuth;
declare const index_EdgeworkAuth: typeof EdgeworkAuth;
type index_EncryptedSecretFact = EncryptedSecretFact;
type index_IOracleService = IOracleService;
type index_LicenseInfo = LicenseInfo;
type index_LicenseNFT = LicenseNFT;
type index_MockOracleClient = MockOracleClient;
declare const index_MockOracleClient: typeof MockOracleClient;
type index_OracleClient = OracleClient;
declare const index_OracleClient: typeof OracleClient;
type index_OracleConfig = OracleConfig;
type index_PaidApiProvider = PaidApiProvider;
type index_PaidApiUCANOptions = PaidApiUCANOptions;
type index_SecretEncryptionOptions = SecretEncryptionOptions;
type index_StreamingAuth = StreamingAuth;
type index_VerifyRequest = VerifyRequest;
type index_VerifyResponse = VerifyResponse;
type index_WalletAuth = WalletAuth;
declare const index_WalletAuth: typeof WalletAuth;
type index_WalletState = WalletState;
declare const index_checkLicenseNFT: typeof checkLicenseNFT;
declare const index_clearPublicKeyCache: typeof clearPublicKeyCache;
declare const index_createMockOracleClient: typeof createMockOracleClient;
declare const index_createOracleClient: typeof createOracleClient;
declare const index_createPaidApiUCAN: typeof createPaidApiUCAN;
declare const index_createWalletAuth: typeof createWalletAuth;
declare const index_encryptApiSecret: typeof encryptApiSecret;
declare const index_extractEncryptedSecret: typeof extractEncryptedSecret;
declare const index_fetchCogPublicKey: typeof fetchCogPublicKey;
declare const index_isValidEncryptedSecret: typeof isValidEncryptedSecret;
declare namespace index {
  export { type index_AuthService as AuthService, type index_AuthSession as AuthSession, type index_ChallengeRequest as ChallengeRequest, type index_ChallengeResponse as ChallengeResponse, type index_CogPublicKeyInfo as CogPublicKeyInfo, type index_EIP1193Provider as EIP1193Provider, index_EdgeworkAuth as EdgeworkAuth, type index_EncryptedSecretFact as EncryptedSecretFact, type index_IOracleService as IOracleService, type index_LicenseInfo as LicenseInfo, type index_LicenseNFT as LicenseNFT, index_MockOracleClient as MockOracleClient, index_OracleClient as OracleClient, type index_OracleConfig as OracleConfig, type index_PaidApiProvider as PaidApiProvider, type index_PaidApiUCANOptions as PaidApiUCANOptions, type index_SecretEncryptionOptions as SecretEncryptionOptions, type index_StreamingAuth as StreamingAuth, type index_VerifyRequest as VerifyRequest, type index_VerifyResponse as VerifyResponse, index_WalletAuth as WalletAuth, type index_WalletState as WalletState, index_checkLicenseNFT as checkLicenseNFT, index_clearPublicKeyCache as clearPublicKeyCache, index_createMockOracleClient as createMockOracleClient, index_createOracleClient as createOracleClient, index_createPaidApiUCAN as createPaidApiUCAN, index_createWalletAuth as createWalletAuth, index_encryptApiSecret as encryptApiSecret, index_extractEncryptedSecret as extractEncryptedSecret, index_fetchCogPublicKey as fetchCogPublicKey, index_isValidEncryptedSecret as isValidEncryptedSecret };
}

export { type AuthService as A, type ChallengeRequest as C, type EIP1193Provider as E, type IOracleService as I, type LicenseInfo as L, MockOracleClient as M, OracleClient as O, type PaidApiProvider as P, type SecretEncryptionOptions as S, type VerifyRequest as V, WalletAuth as W, type AuthSession as a, type ChallengeResponse as b, type CogPublicKeyInfo as c, EdgeworkAuth as d, type EncryptedSecretFact as e, type LicenseNFT as f, type OracleConfig as g, type PaidApiUCANOptions as h, index as i, type StreamingAuth as j, type VerifyResponse as k, type WalletState as l, checkLicenseNFT as m, clearPublicKeyCache as n, createMockOracleClient as o, createOracleClient as p, createPaidApiUCAN as q, createWalletAuth as r, encryptApiSecret as s, extractEncryptedSecret as t, fetchCogPublicKey as u, isValidEncryptedSecret as v };