import type { AithosAuth } from "./auth.js";
import { AgentNamespace } from "./agent.js";
import { AppsNamespace } from "./apps.js";
import { ComputeNamespace, type ComputeWorkingSet } from "./compute.js";
import { type AithosSdkEndpoints } from "./endpoints.js";
import { EthosNamespace, type ZoneName } from "./ethos.js";
import { MandatesNamespace } from "./mandates.js";
import { WalletNamespace } from "./wallet.js";
import { WebNamespace } from "./web.js";
export interface AithosSDKConfig {
    /**
     * The {@link AithosAuth} instance the SDK reads sign-in state from.
     * Constructed and managed by the app — typically a singleton at the
     * top of the application tree.
     */
    readonly auth: AithosAuth;
    /**
     * Application DID — identifies the calling app in mandates, audit
     * logs, billing splits. Issued at developer onboarding (will be
     * self-service before 0.1.0 stable).
     */
    readonly appDid: string;
    /**
     * Optional endpoint overrides. Production defaults point at the
     * Aithos infrastructure; pass overrides for staging, self-hosting,
     * tests.
     */
    readonly endpoints?: Partial<AithosSdkEndpoints>;
    /**
     * Optional `fetch` implementation. Defaults to the global `fetch`.
     * Used by tests to inject a mock without monkeypatching globals.
     */
    readonly fetch?: typeof fetch;
    /**
     * Read-amplification caches for the publish path (protocol-client's
     * opt-in perf caches). Every publish needs the subject's did.json and the
     * owner's active delegate grants; without caching those are 3 extra
     * round-trips per publish even when nothing changed seconds earlier.
     *
     * Defaults: did.json 60 s, delegate grants 30 s. The SDK invalidates the
     * grants cache itself on `mandates.create()` / `mandates.revoke()`, so
     * same-device mandate changes are always sealed on the next publish; the
     * TTL only bounds staleness for mandates minted from ANOTHER device. Pass
     * `0` to disable either cache (always-fresh, pre-alpha.76 behaviour).
     */
    /**
     * @deprecated No longer has any effect. v0.4 migration is now an explicit,
     * owner-only action — call `sdk.ethos.migrateToV04()`. `publish()` never
     * migrates a subject. Kept optional so existing callers don't break.
     */
    readonly ethosV04?: boolean;
    readonly perfCaches?: {
        readonly identityTtlMs?: number;
        readonly delegateGrantsTtlMs?: number;
    };
}
export declare class AithosSDK {
    /** Resolved endpoint configuration (defaults + caller overrides). */
    readonly endpoints: AithosSdkEndpoints;
    /** Application DID (as declared in mandates). */
    readonly appDid: string;
    /** The same auth instance the app constructed and passed in. */
    readonly auth: AithosAuth;
    /** Compute proxy namespace — Bedrock invocation. */
    readonly compute: ComputeNamespace;
    /**
     * Agent namespace — `sdk.agent.run()`: the client-side agentic loop with
     * tools served by an in-process Aithos MCP server (reads decrypt local,
     * writes stage + publish with the session keys). P1 of the MCP unification.
     */
    readonly agent: AgentNamespace;
    /** Wallet namespace — Stripe top-up. */
    readonly wallet: WalletNamespace;
    /** Ethos editing namespace — load, mutate (staged), publish. */
    readonly ethos: EthosNamespace;
    /** Mandate lifecycle namespace — create / list / revoke. */
    readonly mandates: MandatesNamespace;
    /** Web extraction namespace — aithos.web_extract through the web extractor proxy. */
    readonly web: WebNamespace;
    /**
     * App lifecycle namespace — sponsorship mandates + app-credit top-ups.
     * V0.1 (2026-05-27 — draft §13). Lets a developer pre-pay a pool that
     * funds compute calls from their app's users within explicit caps.
     */
    readonly apps: AppsNamespace;
    constructor(config: AithosSDKConfig);
    /** DID of the currently signed-in owner, or null if no owner is loaded. */
    get userDid(): string | null;
    /**
     * Build the client-decrypted working-set for an agentic conversation.
     *
     * Reads the requested ethos zones for `did` through {@link EthosNamespace}
     * (which decrypts client-side using the active owner/delegate keys) and
     * packages them into the {@link ComputeWorkingSet} shape that
     * `sdk.compute.runConversation({ workingSet })` consumes.
     *
     * Only zones the session can actually read are included: a zone the
     * mandate does not grant (or whose delegate wrap is missing) throws
     * `ethos_zone_unreadable` / `ethos_anonymous_private_zone` on read and is
     * silently skipped — so the working-set is naturally bounded by what the
     * caller is authorized to see. The proxy never holds a decryption key;
     * this is where the plaintext is produced (see PLATFORM-COMPUTE-AGENTIC-MCP.md §4).
     *
     * Structured (gamma) data collections are not loaded here in v1 — attach
     * them to the returned object's `data` field yourself if needed.
     *
     * @param did     Subject DID whose ethos to read (usually the signed-in owner).
     * @param opts.zones  Zones to attempt. Defaults to all three.
     */
    buildWorkingSet(did: string, opts?: {
        readonly zones?: readonly ZoneName[];
    }): Promise<ComputeWorkingSet>;
}
//# sourceMappingURL=sdk.d.ts.map