import { type KdfParams } from "@aithos/protocol-client";
interface HttpClient {
    readonly fetchImpl: typeof fetch;
    readonly authBaseUrl: string;
}
export interface RegisterApiInput {
    readonly email: string;
    readonly handle: string;
    readonly displayName: string;
    readonly did: string;
    readonly authKey: Uint8Array;
    readonly authSalt: Uint8Array;
    readonly encSalt: Uint8Array;
    readonly kdf: KdfParams;
    readonly blob: Uint8Array;
    readonly blobNonce: Uint8Array;
    readonly blobVersion: number;
}
export interface RegisterApiResponse {
    readonly session: string;
    readonly exp: number;
}
export declare function registerAccount(http: HttpClient, input: RegisterApiInput): Promise<RegisterApiResponse>;
export interface PutBlobApiInput {
    readonly jwt: string;
    readonly blob: Uint8Array;
    readonly blobNonce: Uint8Array;
    readonly blobVersion: number;
}
export declare function putBlob(http: HttpClient, input: PutBlobApiInput): Promise<{
    ok: true;
}>;
export interface LoginChallengeResponse {
    readonly authSalt: Uint8Array;
    readonly encSalt: Uint8Array;
    readonly kdf: KdfParams;
}
export declare function loginChallenge(http: HttpClient, email: string): Promise<LoginChallengeResponse>;
export interface LoginVerifyResponse {
    readonly session: string;
    readonly exp: number;
    readonly did: string;
    readonly handle: string;
    readonly blob: Uint8Array;
    readonly blobNonce: Uint8Array;
    readonly blobVersion: number;
}
export declare function loginVerify(http: HttpClient, email: string, authKey: Uint8Array): Promise<LoginVerifyResponse>;
/**
 * Input for {@link custodialSignUp}. Caller authenticates the app via ONE
 * of `apiKey` (server-only secret) or `publicKey` (browser-safe). The
 * user's `password` is always required — sign-up no longer auto-generates
 * one server-side. The created account starts in a *pending* state and
 * the user must click the link sent to their inbox before they can
 * sign in.
 */
export interface CustodialSignUpApiInput {
    /** Server-only Bearer secret: `aithos_<env>_<…>`. Mutually exclusive
     *  with `publicKey`. Use this from your backend. */
    readonly apiKey?: string;
    /** Browser-safe public client key: `pk_<env>_<…>`. Mutually exclusive
     *  with `apiKey`. The browser sends its `Origin` header alongside; the
     *  Aithos backend matches it against the app's allowed_origins list. */
    readonly publicKey?: string;
    readonly email: string;
    /** Raw password the user chose. Must be ≥ 10 chars and mix letters
     *  with at least one digit or symbol (server-side rule). */
    readonly password: string;
    readonly displayName?: string;
    readonly handleHint?: string;
}
export interface CustodialSignUpApiResponse {
    /** Always "pending_verification" — sign-in is blocked until the
     *  user clicks the confirmation link. */
    readonly status: "pending_verification";
    readonly email: string;
    readonly mailSent: boolean;
    readonly mailMessageId?: string;
}
/**
 * Provision a custodial-mode account on behalf of a registered app.
 *
 * Two integration paths:
 *   - **Backend** caller passes `apiKey` (server-only secret).
 *   - **Browser** caller passes `publicKey` (safe to ship in the bundle).
 *     The browser also sends its `Origin` header automatically and the
 *     auth backend validates it against the app's allowed_origins list.
 *
 * On success the account exists in DDB with `email_verified: false` and
 * the response carries `status: "pending_verification"` — call
 * {@link custodialVerifyEmail} after the user clicks the confirmation
 * link before attempting sign-in.
 */
export declare function custodialSignUp(http: HttpClient, input: CustodialSignUpApiInput): Promise<CustodialSignUpApiResponse>;
export interface CustodialVerifyEmailApiInput {
    readonly email: string;
    readonly token: string;
}
/**
 * Result of consuming the verification link. Magic-link mode: a
 * successful first-time consumption returns a full session payload
 * (JWT + seeds) so the caller can sign the user in without prompting
 * for the password. Replays of the same link (after first consumption)
 * land on `status: "already_verified"` — the user is already verified
 * and must use the regular sign-in flow from now on.
 *
 * The discriminator is the `status` field. Callers should pattern-match.
 */
export type CustodialVerifyEmailApiResponse = {
    readonly status: "signed_in";
    readonly session: string;
    readonly exp: number;
    readonly did: string;
    readonly handle: string;
    readonly displayName: string;
    readonly seed: Uint8Array;
    readonly encKey: Uint8Array;
    readonly blob: Uint8Array;
    readonly blobNonce: Uint8Array;
    readonly blobVersion: number;
} | {
    readonly status: "already_verified";
    readonly email: string;
};
/**
 * Consume the verification token from the confirmation link. On a fresh
 * click: returns a full session payload (magic-link auto-signin). On a
 * replayed click of an already-consumed link: returns
 * `{ status: "already_verified" }`.
 *
 * Throws `auth_token_invalid_or_expired` if the token is wrong, consumed,
 * or past its TTL.
 */
export declare function custodialVerifyEmail(http: HttpClient, input: CustodialVerifyEmailApiInput): Promise<CustodialVerifyEmailApiResponse>;
/**
 * Input for {@link custodialInvite}. The app authenticates via `apiKey`
 * (server-only secret) or `publicKey` (browser-safe, Origin-gated). The
 * `invitePayload` is an OPAQUE app string delivered verbatim to the invitee
 * on {@link custodialAccept}. For Aithos invitations it's a delegate bundle
 * (mandate + seed) serialized as JSON — but the auth backend never parses it;
 * it stores it bound to a single-use token and returns it at accept time.
 */
export interface CustodialInviteApiInput {
    readonly apiKey?: string;
    readonly publicKey?: string;
    readonly email: string;
    /** Opaque payload delivered to the invitee on accept (e.g. a mandate bundle JSON). */
    readonly invitePayload: string;
    /** Token TTL in seconds. Backend clamps to its own min/max. Default backend-side. */
    readonly ttlSeconds?: number;
    /** Optional display name pre-filled on the pending account. */
    readonly displayName?: string;
}
export interface CustodialInviteApiResponse {
    readonly status: "invited";
    readonly email: string;
    readonly mailSent: boolean;
    readonly mailMessageId?: string;
}
/**
 * Send an invitation magic link carrying an opaque payload. The backend
 * mints a single-use token, stores `{ token, email, invite_payload, ttl }`,
 * and emails the magic link (same SES path as the verification mail). The
 * payload (e.g. a mandate bundle) stays server-side — it never rides the
 * email URL. The invitee redeems it via {@link custodialAccept}.
 *
 * No password here: this is an invitation, not an account creation. The
 * invitee chooses their password when they accept.
 */
export declare function custodialInvite(http: HttpClient, input: CustodialInviteApiInput): Promise<CustodialInviteApiResponse>;
export interface CustodialAcceptApiInput {
    readonly email: string;
    readonly token: string;
    /**
     * Password. For a brand-new account the invitee SETS it here; for an
     * existing account they AUTHENTICATE with it. Required unless the backend
     * accepts a session-bound redemption (not in v1).
     */
    readonly password?: string;
}
/**
 * Result of redeeming an invitation. Always `signed_in` on success — the
 * token is consumed, the account is created (or the existing one is
 * authenticated), and a full session payload is returned alongside the
 * `invitePayload` the inviter attached. `accountCreated` distinguishes the
 * two cases for UX.
 */
export interface CustodialAcceptApiResponse {
    readonly status: "signed_in";
    readonly session: string;
    readonly exp: number;
    readonly did: string;
    readonly handle: string;
    readonly displayName: string;
    readonly seed: Uint8Array;
    readonly encKey: Uint8Array;
    readonly blob: Uint8Array;
    readonly blobNonce: Uint8Array;
    readonly blobVersion: number;
    /** The opaque payload the inviter attached (e.g. a mandate bundle JSON). */
    readonly invitePayload: string;
    /** True when a new account was provisioned; false when an existing one signed in. */
    readonly accountCreated: boolean;
}
/**
 * Redeem an invitation token from the magic link. Consumes the token
 * (single-use), creates the account with the supplied password (or
 * authenticates an existing account), and returns a session + the inviter's
 * `invitePayload`.
 *
 * Throws `auth_token_invalid_or_expired` (bad/consumed/expired token) or an
 * auth error if an existing account's password is wrong / a new password is
 * too weak.
 */
export declare function custodialAccept(http: HttpClient, input: CustodialAcceptApiInput): Promise<CustodialAcceptApiResponse>;
/** Re-send the verification mail for a pending account. The backend
 *  is anti-enum (always 200) and rate-limited 1/h/account, so this is
 *  safe to call even when the user state is unknown. Accepts the same
 *  credential families as {@link custodialSignUp}. */
export declare function custodialResendVerify(http: HttpClient, args: {
    readonly email: string;
    readonly apiKey?: string;
    readonly publicKey?: string;
}): Promise<void>;
export interface CustodialSignInApiInput {
    readonly email: string;
    readonly password: string;
}
export interface CustodialSignInApiResponse {
    readonly session: string;
    readonly exp: number;
    readonly did: string;
    readonly handle: string;
    readonly displayName: string;
    /** Raw 32-byte Ed25519 seed — caller MUST hydrate its keystore and
     *  zeroize this buffer. */
    readonly seed: Uint8Array;
    /** Raw 32-byte vault encryption key — same lifecycle. */
    readonly encKey: Uint8Array;
    readonly blob: Uint8Array;
    readonly blobNonce: Uint8Array;
    readonly blobVersion: number;
    readonly passwordMustChange: boolean;
}
export declare function custodialSignIn(http: HttpClient, input: CustodialSignInApiInput): Promise<CustodialSignInApiResponse>;
export declare function custodialResetRequest(http: HttpClient, email: string): Promise<void>;
export interface CustodialResetFinalizeApiInput {
    readonly email: string;
    readonly token: string;
    readonly newPassword: string;
}
export interface CustodialResetFinalizeApiResponse {
    readonly session: string;
    readonly exp: number;
    readonly did: string;
    readonly handle: string;
}
export declare function custodialResetFinalize(http: HttpClient, input: CustodialResetFinalizeApiInput): Promise<CustodialResetFinalizeApiResponse>;
export {};
//# sourceMappingURL=auth-api.d.ts.map