import { F as FiberRpcClient, C as Currency } from '../resolve-B7MJYzSy.js';
export { A as AUTH_TAG_LENGTH, a as AbandonChannelParams, b as AcceptChannelParams, c as AcceptChannelResult, d as Attribute, B as BuildRouterParams, e as BuildRouterResult, f as CancelInvoiceParams, g as CancelInvoiceResult, h as CchInvoice, i as CchOrderStatus, j as CellDep, k as CellOutput, l as Channel, m as ChannelId, n as ChannelState, o as ChannelStateFlags, p as ChannelUpdateInfo, q as CkbInvoice, r as CkbInvoiceStatus, s as CkbTransaction, t as ConnectPeerParams, u as ConnectPeerResult, D as DEFAULT_CKB_ASSET, v as DisconnectPeerParams, E as ENCRYPTED_MAGIC, w as FiberRpcError, x as FormattedChannelBalances, G as GetInvoiceParams, y as GetInvoiceResult, z as GetPaymentParams, H as GetPaymentResult, I as GraphChannelInfo, J as GraphChannelsParams, K as GraphChannelsResult, L as GraphNodeInfo, M as GraphNodesParams, N as GraphNodesResult, O as Hash256, P as HashAlgorithm, Q as HexString, R as HopHint, S as HopRequire, T as Htlc, U as IFiberClient, V as IV_LENGTH, W as InvoiceData, X as InvoiceSignature, Y as JsonRpcError, Z as JsonRpcRequest, _ as JsonRpcResponse, $ as KEY_LENGTH, a0 as ListChannelsParams, a1 as ListChannelsResult, a2 as ListPaymentsParams, a3 as ListPaymentsResult, a4 as ListPeersResult, a5 as Multiaddr, a6 as NewInvoiceParams, a7 as NewInvoiceResult, a8 as NodeInfo, a9 as NodeInfoResult, aa as OpenChannelParams, ab as OpenChannelResult, ac as OpenChannelWithExternalFundingParams, ad as OpenChannelWithExternalFundingResult, ae as OutPoint, af as ParseInvoiceParams, ag as ParseInvoiceResult, ah as PaymentCustomRecords, ai as PaymentHash, aj as PaymentInfo, ak as PaymentStatus, al as PeerId, am as PeerInfo, an as Privkey, ao as Pubkey, ap as RemoveTlcReason, aq as ResolveUdtAssetOptions, ar as RevocationData, as as RouterHop, at as SALT_LENGTH, au as SCRYPT_N, av as SCRYPT_P, aw as SCRYPT_R, ax as Script, ay as SendPaymentParams, az as SendPaymentResult, aA as SendPaymentWithRouterParams, aB as SessionRoute, aC as SessionRouteNode, aD as SettleInvoiceParams, aE as SettlementData, aF as SettlementTlc, aG as ShutdownChannelParams, aH as SubmitSignedFundingTxParams, aI as SubmitSignedFundingTxResult, aJ as TLCId, aK as TlcStatus, aL as TransportType, aM as UdtArgInfo, aN as UdtAsset, aO as UdtCellDep, aP as UdtCfgInfos, aQ as UdtDep, aR as UdtScript, aS as UdtTypeScript, aT as UpdateChannelParams, aU as areUdtTypeScriptsEqual, aV as buildMultiaddr, aW as buildMultiaddrFromNodeId, aX as buildMultiaddrFromRpcUrl, aY as ckbHash, aZ as ckbToShannons, a_ as decryptKey, a$ as derivePublicKey, b0 as ensureHexPrefix, b1 as formatAssetName, b2 as formatChannelBalances, b3 as fromHex, b4 as generatePreimage, b5 as generatePrivateKey, b6 as hashPreimage, b7 as isEncryptedKey, b8 as nodeIdToPeerId, b9 as normalizeChannel, ba as normalizeChannelStateName, bb as parseFundingAmount, bc as parsePaymentAmount, bd as parseUdtTypeScript, be as randomBytes32, bf as resolveUdtAsset, bg as scriptToAddress, bh as serializeUdtTypeScript, bi as sha256Hash, bj as shannonsToCkb, bk as toHex, bl as validateUdtTypeScript, bm as verifyPreimageHash } from '../resolve-B7MJYzSy.js';
export { AgentSession, AuditAction, AuditLogEntry, BiscuitAction, BiscuitMethodRule, BiscuitPermission, ChannelPolicy, ChannelPolicySchema, CollectBiscuitPermissionsOptions, DEFAULT_SECURITY_POLICY, InvoiceVerificationResult, InvoiceVerifier, KeyConfig, KeyInfo, LiquidityAnalyzer, LiquidityReport, PolicyCheckResult, PolicyEngine, PolicyViolation, RateLimit, RateLimitSchema, RecipientPolicy, RecipientPolicySchema, SecurityPolicy, SecurityPolicySchema, SpendingLimit, SpendingLimitSchema, ViolationType, collectBiscuitPermissions, getBiscuitRuleForMethod, listSupportedBiscuitMethods, renderBiscuitFactsForMethods, renderBiscuitPermissionFacts } from '../index.js';
import { Request, Response, NextFunction } from 'express';
import 'zod';

/**
 * MacaroonService
 *
 * Handles L402 macaroon minting, verification, and caveat management.
 * Uses the `macaroon` npm package for cryptographic operations and
 * Node.js built-in `crypto` for SHA-256 hashing.
 */
interface MacaroonCaveat {
    condition: string;
    value: string;
}
interface MintParams {
    identifier: string;
    paymentHash: string;
    resourceId?: string;
    resourceType?: string;
    expirySeconds?: number;
    location?: string;
}
interface VerifyResult {
    valid: boolean;
    error?: string;
    caveats?: Record<string, string>;
}
declare class MacaroonService {
    private rootKey;
    constructor(rootKey?: string);
    /**
     * Mint a new macaroon with embedded caveats.
     *
     * The macaroon identifier encodes the payment hash, resource info, and
     * version. First-party caveats are added for payment_hash, expiry, and
     * optionally resource_id / resource_type.
     */
    mint(params: MintParams): {
        macaroon: string;
        caveats: MacaroonCaveat[];
    };
    /**
     * Verify a macaroon with a payment preimage.
     *
     * Validates:
     * 1. SHA-256(preimage) === payment_hash in the macaroon identifier
     * 2. Macaroon signature against root key
     * 3. Expiry caveat is not past
     */
    verify(macaroonB64: string, preimage: string): VerifyResult;
    /**
     * Verify macaroon signature and caveats without requiring a preimage.
     *
     * Used in the "connected-node" flow where the middleware verifies
     * invoice settlement via Fiber RPC instead of requiring the client
     * to provide the preimage directly.
     */
    verifyWithoutPreimage(macaroonB64: string): VerifyResult;
    /** Extract caveats from a macaroon without full verification. */
    extractCaveats(macaroonB64: string): Record<string, string>;
    private generateRootKey;
}

/**
 * L402 Protocol Types
 *
 * Type definitions for the L402 (HTTP 402 + Macaroon + Lightning Invoice)
 * payment protocol. These types are framework-agnostic where possible;
 * Express-specific types are isolated behind optional peer dependency.
 */

/** Fiber Network invoice used in L402 challenges. */
interface L402Invoice {
    paymentHash: string;
    invoiceAddress: string;
    amount: string;
    description: string;
    expiry: number;
    createdAt: number;
}
/** Authorization token combining macaroon + payment preimage. */
interface L402Token {
    macaroon: string;
    preimage: string;
}
/** Data returned in a 402 response. */
interface L402Challenge {
    macaroon: string;
    invoice: string;
}
/** Core L402 configuration. */
interface L402Config {
    /** Hex string for macaroon signing (32 bytes / 64 hex chars). Falls back to L402_ROOT_KEY env or a secure random key. */
    rootKey?: string;
    /** Default expiry for macaroon + invoice in seconds. Default: 3600. */
    expirySeconds: number;
    /** Default price in CKB. */
    priceCkb: number;
}
/** Express request augmented with L402 validation result. */
interface L402Request extends Request {
    l402?: {
        valid: boolean;
        preimage?: string;
        paymentHash?: string;
        token?: L402Token;
    };
}
/** Full middleware configuration including rate limiting. */
interface L402MiddlewareConfig extends L402Config {
    rateLimitWindowMs: number;
    rateLimitMaxRequests: number;
}
/** In-memory challenge store interface. */
interface ChallengeStore {
    get(key: string): L402Challenge | undefined;
    set(key: string, value: L402Challenge): void;
    delete(key: string): void;
    has(key: string): boolean;
}
/** Metadata about a protected resource (used for dynamic pricing). */
interface ProtectedResourceInfo {
    id?: string;
    type?: string;
    priceCkb?: number;
}
/** Resolves request → resource info for dynamic pricing. */
interface ResourceResolver {
    name: string;
    matches(req: Request): boolean;
    resolve(req: Request): Promise<ProtectedResourceInfo | undefined>;
}
/** Registry that matches requests to the appropriate resolver. */
interface ResourceResolverRegistry {
    register(resolver: ResourceResolver): void;
    resolve(req: Request): Promise<ProtectedResourceInfo | undefined>;
}

/**
 * L402 Middleware for Express
 *
 * Protects routes with the L402 payment protocol. On unauthenticated
 * requests it issues a 402 challenge (macaroon + Fiber invoice); on
 * subsequent requests it verifies the L402 token.
 *
 * Two verification paths are supported:
 *   Path A — client provides macaroon:preimage (legacy / manual flow)
 *   Path B — client provides macaroon only; middleware checks invoice
 *            settlement via Fiber RPC (connected-node flow)
 *
 * Uses `FiberRpcClient` from `@fiber-pay/sdk/node` directly for invoice
 * creation and settlement checks, eliminating the intermediate
 * InvoiceService abstraction from the upstream fiber-l402 SDK.
 */

interface L402ResourceResolver {
    resolve(req: Request): Promise<ProtectedResourceInfo | undefined>;
}
type LegacyResourceProvider = (req: Request) => Promise<ProtectedResourceInfo | undefined> | ProtectedResourceInfo | undefined;
declare class L402Middleware {
    private config;
    private rateLimitStore;
    private macaroonService;
    private rpcClient;
    private resourceResolver?;
    private currency;
    constructor(config?: Partial<L402MiddlewareConfig> & {
        /** Pre-configured RPC client. Takes precedence over rpcUrl. */
        rpcClient?: FiberRpcClient;
        /** Fiber node RPC URL. Used when rpcClient is not provided. */
        rpcUrl?: string;
        /** Biscuit token for Fiber RPC authentication. */
        biscuitToken?: string;
        /** Invoice currency. Default: 'Fibt' (testnet). */
        currency?: Currency;
        /** Resource resolver registry for dynamic pricing. */
        resourceResolver?: L402ResourceResolver;
        /** @deprecated Use resourceResolver instead. */
        resourceProvider?: LegacyResourceProvider;
    });
    handle(req: L402Request, res: Response, next: NextFunction): Promise<void>;
    private validateResourceCaveats;
    private validatePaymentHashHeader;
    private checkRateLimit;
    private issueChallenge;
    private createChallenge;
}
/**
 * Create an L402 middleware function for Express.
 *
 * @example
 * ```ts
 * import express from 'express';
 * import { createL402Middleware } from '@fiber-pay/sdk/node';
 *
 * const app = express();
 *
 * app.get('/api/premium/*', createL402Middleware({
 *   rootKey: process.env.L402_ROOT_KEY,
 *   priceCkb: 0.1,
 *   expirySeconds: 3600,
 * }));
 * ```
 */
declare function createL402Middleware(config?: Partial<L402MiddlewareConfig> & {
    rpcClient?: FiberRpcClient;
    rpcUrl?: string;
    biscuitToken?: string;
    currency?: Currency;
    resourceResolver?: L402ResourceResolver;
    resourceProvider?: LegacyResourceProvider;
}): (req: L402Request, res: Response, next: NextFunction) => Promise<void>;

/**
 * Default Resource Resolver Registry
 *
 * Iterates registered resolvers to match incoming requests to protected
 * resource metadata (id, type, price). Used by L402Middleware for
 * dynamic per-resource pricing.
 */

declare class DefaultResourceResolverRegistry implements ResourceResolverRegistry {
    private resolvers;
    constructor(resolvers?: ResourceResolver[]);
    register(resolver: ResourceResolver): void;
    resolve(req: Request): Promise<ProtectedResourceInfo | undefined>;
}

export { type ChallengeStore, Currency, DefaultResourceResolverRegistry, FiberRpcClient, type L402Challenge, type L402Config, type L402Invoice, L402Middleware, type L402MiddlewareConfig, type L402Request, type L402Token, type MacaroonCaveat, MacaroonService, type MintParams, type ProtectedResourceInfo, type ResourceResolver, type ResourceResolverRegistry, type VerifyResult, createL402Middleware };