import { BytesType } from "@ocap/util";

//#region src/index.d.ts
type JwtBody = {
  iss: string;
  iat: string;
  nbf: string;
  exp: string;
  version: string;
  [key: string]: any;
};
type JwtHeader = {
  alg: string;
  type: 'JWT';
};
type JwtToken = {
  header: JwtHeader;
  body: JwtBody;
  signature: string;
};
type JwtVerifyOptions = Partial<{
  tolerance: number;
  enforceTimestamp: boolean;
  signerKey: string;
}>;
/**
 *
 *
 * @param {string} signer - address string
 * @param {string} sk - hex encoded secret key
 * @param {*} [payload={}] - data to be included before signing
 * @param {boolean} [doSign=true] - do we need to sign the payload or just return the content to be signed
 * @param {string} [version='1.0.0']
 * @return {*}  {string} - hex encoded signature
 */
declare function sign(signer: string, sk?: BytesType, payload?: {}, doSign?: boolean, version?: string): Promise<string>;
declare function signV2(signer: string, sk?: BytesType, payload?: any): Promise<string>;
type PasskeyAssertion = {
  authenticatorData: string;
  clientDataJSON: string;
  signature: string;
};
/**
 * Compute the WebAuthn challenge for an unsigned JWT token.
 * Always uses SHA3 hash-before-sign (v1.1.0 semantics, required for passkey).
 *
 * @param unsignedToken - the unsigned token (headerB64.bodyB64), may also accept 3-part tokens (ignores third segment)
 * @returns hex-encoded SHA3 hash suitable as WebAuthn challenge
 */
declare function getChallenge(unsignedToken: string): string;
/**
 * Assemble a complete JWT from an unsigned token and a passkey assertion.
 * The assertion is JSON-serialized and base64-encoded as the JWT's third segment.
 *
 * @param unsignedToken - the unsigned token (headerB64.bodyB64)
 * @param assertion - WebAuthn assertion with base64url-encoded fields
 * @returns complete 3-part JWT string
 */
declare function assemble(unsignedToken: string, assertion: PasskeyAssertion): string;
declare function decode(token: string, bodyOnly?: true): JwtBody;
declare function decode(token: string, bodyOnly?: false): JwtToken;
/**
 * Verify a jwt token
 *
 * @param {string} token  - the jwt token
 * @param {string} signerPk - signer public key
 * @param {{
 *     tolerance: number; - number of seconds to tolerant expire
 *     enforceTimestamp: boolean; - whether should be verify timestamps?
 *     signerKey: string; - which field should be used to pick the signer
 *   }} [{
 *     tolerance,
 *     enforceTimestamp,
 *     signerKey,
 *   }={
 *       tolerance: 5,
 *       enforceTimestamp: true,
 *       signerKey: 'iss',
 *     }]
 * @return {*}  {boolean}
 */
declare function verify(token: string, signerPk: BytesType, options?: JwtVerifyOptions): Promise<boolean>;
type DelegationTokenHeader = {
  alg: string;
  typ: 'DelegationToken';
};
type DelegationTokenBody = {
  iss: string;
  sub: string;
  iat: string;
  nbf: string;
  exp: string;
  version: string;
  ops: string[];
  deny?: string[];
  pk: string;
  delegation?: string;
};
type DelegationToken = {
  header: DelegationTokenHeader;
  body: DelegationTokenBody;
  signature: string;
};
declare function signDelegationToken(signer: string, sk: BytesType, payload: {
  sub: string;
  ops: string[];
  deny?: string[];
  delegation?: string;
  iat?: string;
  nbf?: string;
  exp?: string;
}): Promise<string>;
/**
 * Create an unsigned delegation token for passkey two-phase signing.
 * Unlike signDelegationToken, this does not sign (passkey has no sk), and pk is passed directly.
 */
declare function signDelegationTokenUnsigned(signer: string, pk: BytesType, payload: {
  sub: string;
  ops: string[];
  deny?: string[];
  delegation?: string;
  iat?: string;
  nbf?: string;
  exp?: string;
}): Promise<string>;
/**
 * Assemble a complete delegation token from an unsigned token and a passkey assertion.
 */
declare function assembleDelegationToken(unsignedToken: string, assertion: PasskeyAssertion): string;
declare function decodeDelegationToken(token: string): DelegationToken;
declare function verifyDelegationToken(token: string): Promise<boolean>;
declare function checkDelegationTokenScope(scope: string, {
  ops,
  deny
}: {
  ops: string[];
  deny?: string[];
}): boolean;
//#endregion
export { DelegationToken, DelegationTokenBody, DelegationTokenHeader, JwtBody, JwtHeader, JwtToken, JwtVerifyOptions, PasskeyAssertion, assemble, assembleDelegationToken, checkDelegationTokenScope, decode, decodeDelegationToken, getChallenge, sign, signDelegationToken, signDelegationTokenUnsigned, signV2, verify, verifyDelegationToken };