import { g as Ed25519SpendSigner, I as Identity, W as WalletRegistry, S as SocialRecoveryCredential, a as SocialRecoveryClient, E as EnclaveDekPort, d as PasskeyPrfProvider, D as DeviceFactor, b as WrapStore, c as Ed25519Seed, f as AttestationPolicy, M as MasterDEK, w as ControlKey, e as PrivacySdk, x as PrivacySessionDeps, y as VaultRequest } from '../VaultClient-CkzLCyXH.mjs';
export { z as ConnectParams, B as ConnectResult, F as DEFAULT_VAULT_URL, G as POPUP_READY, H as POPUP_RESULT, J as PopupIntent, K as PopupResult, N as RecoveryMode, O as VAULT_HELLO, Q as VAULT_READY, T as VaultChain, V as VaultClient, U as VaultClientOptions, X as VaultEvent, Y as VaultMethod, Z as VaultMethods, _ as VaultParams, $ as VaultReply, a0 as VaultResult } from '../VaultClient-CkzLCyXH.mjs';
import { S as StarknetSpend, a as StarknetPrivacyConfig } from '../nativeConnect-DPJqSwJj.mjs';
import { D as DeviceUnwrapKey } from '../DeviceUnwrapKey-Ct-JUQrB.mjs';
import 'starknet';
import '@starkware-libs/starknet-privacy-sdk';

type NativeChain = "solana" | "stellar" | "starknet";

/** One passkey's encrypted copy of the DEK, and the passkey it opens with. */
interface StoredPasskeyWrap {
    credentialId: Uint8Array;
    wrap: Uint8Array;
}
/** Where passkey wraps live. They are ciphertext: the store never sees what they protect. */
interface PasskeyWrapStore {
    list(userId: string): Promise<StoredPasskeyWrap[]>;
    save(userId: string, entry: StoredPasskeyWrap): Promise<void>;
}

interface ResolveNativeInput<S extends {
    address(): string;
} = Ed25519SpendSigner> {
    chain: NativeChain;
    identity: Identity;
    appSalt: string;
    registry: WalletRegistry;
    credential?: SocialRecoveryCredential;
    socialRecovery?: SocialRecoveryClient;
    recovery?: EnclaveDekPort;
    /** Restores a registered account on a new device, from a passkey the user added. Needs `passkeyWraps` and `appId`. */
    passkey?: PasskeyPrfProvider;
    passkeyWraps?: PasskeyWrapStore;
    appId?: string;
    factor?: DeviceFactor;
    store?: WrapStore;
    importSpend?: (seed: Ed25519Seed, keyId: string) => Promise<S>;
    loadPersisted?: (keyId: string) => Promise<S | null>;
    /**
     * Prefixes every stored key. The vault passes the app id, so one app can
     * never load another app's keys from the same browser storage.
     */
    keyScope?: string;
}

interface LocalDekInput {
    chain: NativeChain;
    userId: string;
    appSalt: string;
    /** The account's address. The DEK is refused unless it derives it. */
    address: string;
    /** The same scope connect used; the vault passes the app id. */
    keyScope?: string;
    store?: WrapStore;
    unwrapKey?: DeviceUnwrapKey;
}

/** What happens to a transaction the limits do not cover. */
type OverLimit = "ask" | "block" | "sign";
/**
 * A cap for one asset, in whole units as a person writes them ("0.5").
 * `asset` is "SOL", "XLM", a Solana mint, a Stellar "CODE:ISSUER", or on
 * Starknet one of "ETH", "STRK", "USDC".
 */
interface VaultLimit {
    chain: "solana" | "stellar" | "starknet";
    asset: string;
    perTx: string;
    perDay: string;
}
/** Set per app in the Cavos dashboard and read by the vault from Cavos, never from the app. */
interface VaultPolicy {
    overLimit: OverLimit;
    limits: VaultLimit[];
}
/** Used when the app's policy cannot be read: nothing is signed without the user. */
declare const STRICT_POLICY: VaultPolicy;

interface Spend {
    asset: string;
    /** Base units: lamports, stroops, or the token's smallest unit. */
    amount: bigint;
    decimals: number;
}
/** What the user reads when the vault asks: sends get their own layout, everything else a line of text. */
type Line = {
    kind: "send";
    amount: string;
    asset: string;
    to: string;
} | {
    kind: "action";
    text: string;
    target?: string;
};
interface ParsedTx {
    spends: Spend[];
    lines: Line[];
    /** Signer changes, unknown programs: never inside a limit, so the app's over-limit rule decides. */
    flagged: boolean;
}
type Decision = "sign" | "confirm" | "block";
declare function evaluate(tx: ParsedTx, spentToday: ReadonlyMap<string, bigint>, policy: VaultPolicy): Decision;

interface SpendLedger {
    spentToday(userId: string, asset: string): Promise<bigint>;
    record(userId: string, spends: Spend[]): Promise<void>;
}

type NativeBase = Omit<ResolveNativeInput, "chain" | "importSpend" | "loadPersisted">;
interface VaultHandlerDeps {
    appId: string;
    backendUrl: string;
    attestation?: AttestationPolicy;
    policy: VaultPolicy;
    ledger: SpendLedger;
    confirm(lines: Line[], context: {
        network: string;
    }): Promise<boolean>;
    passkey(user: {
        userId: string;
        userName: string;
    }): PasskeyPrfProvider;
    passkeyWraps?: (auth: {
        environment?: "development" | "production";
        authToken?: string | null;
    }) => PasskeyWrapStore;
    readDek?: (input: LocalDekInput) => Promise<MasterDEK>;
    resolveSolana?: (input: NativeBase) => Promise<{
        address: string;
        spend: Ed25519SpendSigner | null;
        isNewAccount: boolean;
    }>;
    resolveStellar?: (input: NativeBase) => Promise<{
        address: string;
        control?: ControlKey;
        isNewAccount: boolean;
    }>;
    resolveStarknet?: (input: NativeBase) => Promise<{
        address: string;
        spend: StarknetSpend | null;
        isNewAccount: boolean;
    }>;
    solanaNetwork?: (recentBlockhash: string) => Promise<string>;
    /** Private transfer settings of the app for a network ("sepolia", "mainnet"), from the Cavos dashboard. Throws on an invalid one. */
    privacy?: (network: string) => StarknetPrivacyConfig | undefined;
    /** Loads the privacy SDK. Only a vault build that bundles it passes one. */
    privacySdk?: () => Promise<PrivacySdk>;
    privacyDeps?: PrivacySessionDeps;
}
declare function createVaultHandler(deps: VaultHandlerDeps): (request: VaultRequest) => Promise<unknown>;
interface VaultHostOptions {
    /** Cavos backend for the registry and the enclave. Never taken from the app. */
    backendUrl: string;
    attestation?: AttestationPolicy;
    /** Defaults to `/vault/confirm` on this origin. */
    confirmUrl?: string;
    /** Defaults to `/api/vault/policy` on this origin. */
    policyUrl?: string;
    privacySdk?: () => Promise<PrivacySdk>;
}
/** Runs inside the vault iframe. One embedding app per iframe. */
declare function startVaultHost(opts: VaultHostOptions): void;

interface VaultConfirmOptions {
    /** Name shown in the passkey prompt. */
    rpName?: string;
}
/** The Cavos window the vault iframe opens for passkeys some browsers refuse inside a frame. */
declare function startVaultConfirm(opts?: VaultConfirmOptions): void;

/**
 * Only instructions that list the account can use its signature, and within
 * them only the roles below are understood. The account anywhere else, or any
 * program not listed here, is outside every limit.
 */
declare function parseSolanaMessage(bytes: Uint8Array, account: string): ParsedTx;

/** Only operations sourced from the account can use its signature. */
declare function parseStellarTransaction(envelope: string, networkPassphrase: string, account: string): ParsedTx;
declare function parseStellarAuthEntry(preimageXdr: Uint8Array): ParsedTx;

export { type Decision, type Line, type OverLimit, type ParsedTx, STRICT_POLICY, type Spend, type VaultConfirmOptions, type VaultHandlerDeps, type VaultHostOptions, type VaultLimit, type VaultPolicy, VaultRequest, createVaultHandler, evaluate, parseSolanaMessage, parseStellarAuthEntry, parseStellarTransaction, startVaultConfirm, startVaultHost };