import { c as ConnectOptions, a as CavosWallet, C as Chain, N as NetworkEnv } from '../Cavos-GquO3aJr.mjs';
import { R as RecoverSolanaOptions, C as CavosSolana } from '../CavosSolana-BgzBk_2P.mjs';
import { D as DeviceUnwrapKey } from '../DeviceUnwrapKey-Ct-JUQrB.mjs';
import * as react from 'react';
import { ReactNode } from 'react';
import { I as Identity, A as AuthProvider, S as SocialRecoveryCredential, L as LocalControlKey, d as PasskeyPrfProvider, h as PasskeyEnrollParams } from '../VaultClient-CkzLCyXH.mjs';
import { C as ChainCall, E as ExecuteOptions, M as MessageSignature } from '../signing-BC_pkVbS.mjs';
import 'starknet';
import '../CavosStellar-DxAYL2pU.mjs';
import '@stellar/stellar-sdk';
import '../nativeConnect-DPJqSwJj.mjs';
import '@solana/web3.js';
import '@starkware-libs/starknet-privacy-sdk';

type NativeSecurityLevel = "secure-enclave" | "strongbox" | "tee" | "os-protected" | "development";
interface NativeCapabilities {
    signingKey: NativeSecurityLevel;
    ecdhKey: NativeSecurityLevel;
    passkey: boolean;
    passkeyPrf: boolean;
}
interface NativeKeyResult {
    publicKey: string;
    securityLevel: NativeSecurityLevel;
}
interface NativePasskeyRegistration {
    credentialId: string;
    publicKey: string;
    prfSecret?: string;
}
interface NativePasskeyAssertionResult {
    authenticatorData: string;
    clientDataJSON: string;
    signature: string;
    prfSecret?: string;
}
/** Result of native ed25519 signing — only signature + public key, never seed. */
interface NativeControlSignResult {
    signature: string;
    publicKey: string;
}
/** Result of native control public key derivation. */
interface NativeControlPublicKeyResult {
    publicKey: string;
}
interface CavosKitNativeModule {
    getOrCreateSigningKey(alias: string): Promise<NativeKeyResult>;
    sign(alias: string, payload: string): Promise<string>;
    getOrCreateUnwrapKey(alias: string): Promise<NativeKeyResult>;
    deriveSharedSecret(alias: string, peerPublicKey: string): Promise<string>;
    deleteKeys(alias: string): Promise<void>;
    getCapabilities(): Promise<NativeCapabilities>;
    randomBytes(length: number): Promise<string>;
    getStoredValue(key: string): Promise<string | null>;
    setStoredValue(key: string, value: string | null): Promise<void>;
    createPasskey(optionsJson: string): Promise<NativePasskeyRegistration>;
    getPasskey(optionsJson: string): Promise<NativePasskeyAssertionResult>;
    /**
     * Native ed25519 signing — the control seed never crosses the JS bridge.
     *
     * Performs ECDH → KEK derivation → DEK unwrap → control seed open → ed25519 sign
     * entirely in native code. The seed is wiped after signing.
     *
     * @param alias - Device key alias (same as getOrCreateUnwrapKey)
     * @param deviceWrap - Base64 ECIES wrap: ephPubCompressed(33) || nonce(12) || ct
     * @param ciphertext - Base64 control ciphertext: nonce(12) || AES-GCM(dek, seed)
     * @param data - Base64 data to sign
     * @returns { signature: base64, publicKey: base64 }
     */
    unwrapControlAndSign(alias: string, deviceWrap: string, ciphertext: string, data: string): Promise<NativeControlSignResult>;
    /**
     * Get the ed25519 public key for a control seed without exposing it to JS.
     *
     * @param alias - Device key alias
     * @param deviceWrap - Base64 ECIES wrap
     * @param ciphertext - Base64 control ciphertext
     * @returns { publicKey: base64 }
     */
    unwrapControlPublicKey(alias: string, deviceWrap: string, ciphertext: string): Promise<NativeControlPublicKeyResult>;
}
declare function nativeModule(): CavosKitNativeModule;

type MinimumKeySecurity = "os-protected" | "hardware";
interface NativeDeviceUnwrapKeyOptions {
    keyId: string;
    minimumKeySecurity?: MinimumKeySecurity;
}
declare class NativeDeviceUnwrapKey implements DeviceUnwrapKey {
    readonly keyId: string;
    readonly securityLevel: NativeSecurityLevel;
    private readonly publicKey;
    private constructor();
    static loadOrCreate(opts: NativeDeviceUnwrapKeyOptions): Promise<NativeDeviceUnwrapKey>;
    publicKeySec1(): Uint8Array;
    slotId(): string;
    unwrap(blob: Uint8Array): Promise<Uint8Array>;
}

interface NativeConnectOptions extends ConnectOptions {
    minimumKeySecurity?: MinimumKeySecurity;
}
/** React Native facade with platform keys injected for every chain. */
declare const Cavos: {
    connect(opts: NativeConnectOptions): Promise<CavosWallet>;
    recoverSolana(opts: RecoverSolanaOptions & {
        minimumKeySecurity?: MinimumKeySecurity;
    }): Promise<CavosSolana>;
};
declare function deleteDeviceKeys(keyId: string): Promise<void>;

interface CavosConfig {
    appId: string;
    environment?: "development" | "production";
    chain?: Chain;
    network: NetworkEnv;
    appSalt: string;
    paymasterApiKey?: string;
    authBackendUrl?: string;
    rpcUrl?: string;
    redirectUri: string;
    rpId: string;
    minimumKeySecurity?: MinimumKeySecurity;
}
interface CavosModalConfig {
    appName?: string;
    providers?: ("google" | "apple" | "email")[];
    secureStep?: "optional" | "required" | "off";
    primaryColor?: string;
    onSuccess?: (address: string) => void;
}
interface WalletStatus {
    isDeploying: boolean;
    isReady: boolean;
    needsDeviceApproval: boolean;
    hasPasskey: boolean;
    isNewAccount: boolean;
}
interface CavosContextValue {
    openModal(): void;
    closeModal(): void;
    isAuthenticated: boolean;
    user: Identity | null;
    chain: Chain;
    wallet: CavosWallet | null;
    address: string | null;
    walletStatus: WalletStatus;
    capabilities: NativeCapabilities | null;
    isLoading: boolean;
    authError: string | null;
    clearAuthError(): void;
    login(provider: "google" | "apple"): Promise<void>;
    sendOtp(email: string): Promise<void>;
    verifyOtp(email: string, code: string): Promise<void>;
    handleCallback(url: string): Promise<void>;
    execute(calls: ChainCall[], opts?: ExecuteOptions): Promise<{
        transactionHash: string;
    }>;
    signMessage(message: string | Uint8Array): Promise<MessageSignature>;
    enrollPasskeyDefault(): Promise<void>;
    approveDeviceWithPasskey(): Promise<void>;
    setupRecovery(): Promise<string>;
    recover(code: string): Promise<void>;
    logout(): Promise<void>;
}
declare function CavosProvider(props: {
    config: CavosConfig;
    modal?: CavosModalConfig;
    children: ReactNode;
}): react.JSX.Element;
declare function useCavos(): CavosContextValue;

interface CavosAuthModalProps {
    open: boolean;
    onClose(): void;
    config: CavosModalConfig;
}
declare function CavosAuthModal({ open, onClose, config }: CavosAuthModalProps): react.JSX.Element;

interface NativeCavosAuthOptions {
    appId: string;
    redirectUri: string;
    backendUrl?: string;
}
type NativeCavosAuthErrorCode = "invalid-config" | "cancelled" | "callback-invalid" | "not-authenticated" | "http-error" | "unsupported";
declare class NativeCavosAuthError extends Error {
    readonly code: NativeCavosAuthErrorCode;
    readonly status?: number | undefined;
    readonly name = "NativeCavosAuthError";
    constructor(code: NativeCavosAuthErrorCode, message: string, status?: number | undefined);
}
declare class NativeCavosAuth implements AuthProvider {
    private readonly opts;
    private readonly backendUrl;
    private readonly storageKey;
    private last;
    /** Never persisted; every recovery requires a fresh social login. */
    private recoveryCredential;
    /** The secret of the login in flight; see `auth/loginBinding`. */
    private loginSecret;
    constructor(opts: NativeCavosAuthOptions);
    restoreIdentity(): Promise<Identity | null>;
    clearStoredIdentity(): Promise<void>;
    login(provider: "google" | "apple"): Promise<Identity>;
    sendOtp(_email: string): Promise<void>;
    verifyOtp(_email: string, _code: string): Promise<Identity>;
    handleCallback(input: string, provider?: string): Promise<Identity>;
    authenticate(): Promise<Identity>;
    getSocialRecoveryCredential(): SocialRecoveryCredential;
    private identityFromAuthData;
    private get;
    private post;
}

/**
 * TODO(android): Implement Kotlin equivalent of iOS unwrapControlAndSign.
 *
 * The iOS implementation (CavosKitModule.swift) uses:
 * - Security framework for P-256 ECDH (SE-backed when available)
 * - CryptoKit for HKDF-SHA256, AES-GCM, Curve25519.Signing
 *
 * For Android, the equivalent would use:
 * - AndroidKeyStore for P-256 ECDH (StrongBox when available)
 * - javax.crypto / BouncyCastle for HKDF, AES-GCM
 * - A pure-Java/Kotlin ed25519 implementation (e.g. TweetNaCl or custom)
 *
 * Until then, NativeControlSigner will throw on Android. The web/JS path
 * (WebCryptoControlKey) works fine on Android React Native since Unit 1
 * ensures the seed is never on the instance.
 */
/**
 * Native ed25519 control key signer for React Native.
 *
 * This implementation keeps the control seed entirely within the native process.
 * Unlike WebCryptoControlKey which imports the seed into WebCrypto (non-extractable),
 * NativeControlSigner never materializes the seed in JavaScript at all — only
 * signatures and the public key cross the JS bridge.
 *
 * **Security model**:
 * - The device's P-256 ECDH key (SE-backed when available) protects the DEK
 * - The DEK unwraps the control seed from the on-chain envelope (cv:ct)
 * - Ed25519 signing happens in native code, using CryptoKit's Curve25519
 * - The native function wipes the seed from memory after signing
 * - No biometric / Face ID prompt — access is AfterFirstUnlockThisDeviceOnly
 *
 * **Usage**:
 * ```ts
 * const signer = await NativeControlSigner.create({
 *   keyId: address,
 *   deviceWrap: env.deviceWraps[deviceKey.slotId()],
 *   ciphertext: env.ct,
 * });
 * const sig = await signer.sign(txHash);
 * ```
 */
declare class NativeControlSigner extends LocalControlKey {
    readonly keyId: string;
    private readonly deviceWrapBase64;
    private readonly ciphertextBase64;
    private readonly publicKeyRawBytes;
    private constructor();
    /**
     * Create a native control signer from the on-chain envelope data.
     *
     * NOTE: Currently iOS only. Android support requires a Kotlin implementation
     * of unwrapControlAndSign — see TODO at top of this file.
     *
     * @param opts.keyId - The device key alias (same as used in NativeDeviceUnwrapKey)
     * @param opts.deviceWrap - This device's ECIES wrap of the DEK from the envelope
     * @param opts.ciphertext - The cv:ct ciphertext containing the encrypted control seed
     */
    static create(opts: {
        keyId: string;
        deviceWrap: Uint8Array;
        ciphertext: Uint8Array;
    }): Promise<NativeControlSigner>;
    publicAddress(): string;
    publicKeyRaw(): Uint8Array;
    /**
     * Sign data with the control key, entirely within the native process.
     *
     * The native function:
     * 1. Performs ECDH with the SE-protected device key
     * 2. Derives KEK and unwraps DEK
     * 3. Opens the control seed from ciphertext
     * 4. Signs with ed25519
     * 5. Wipes the seed from memory
     * 6. Returns only the signature
     *
     * @returns 64-byte Ed25519 signature
     */
    sign(data: Uint8Array): Promise<Uint8Array>;
}

interface NativePasskeyOptions {
    rpId: string;
    rpName?: string;
}
declare class NativePasskeyPrf implements PasskeyPrfProvider {
    private readonly opts;
    constructor(opts: NativePasskeyOptions);
    enroll(params: PasskeyEnrollParams): Promise<{
        credentialId: Uint8Array;
        secret?: Uint8Array;
    }>;
    getSecret(): Promise<Uint8Array>;
}

declare const getNativeCapabilities: () => Promise<NativeCapabilities>;

export { Cavos, CavosAuthModal, type CavosAuthModalProps, type CavosConfig, type CavosContextValue, type CavosModalConfig, CavosProvider, CavosWallet, Chain, Identity, type MinimumKeySecurity, type NativeCapabilities, NativeCavosAuth, NativeCavosAuthError, type NativeCavosAuthErrorCode, type NativeCavosAuthOptions, type NativeConnectOptions, NativeControlSigner, NativeDeviceUnwrapKey, type NativeDeviceUnwrapKeyOptions, type NativePasskeyOptions, NativePasskeyPrf, type NativeSecurityLevel, NetworkEnv, type WalletStatus, deleteDeviceKeys, nativeModule as getCavosNativeModule, getNativeCapabilities, useCavos };