import type { PublicKey } from '@icp-sdk/core/agent';
import { DelegationChain } from '@icp-sdk/core/identity';
import { Principal } from '@icp-sdk/core/principal';
import type { Channel, JsonRpcError, JsonRpcRequest, JsonRpcResponse, Transport } from './transport.js';
/**
 * A function that transforms a JSON-RPC request before it is sent to the signer.
 * Transforms are applied in order and each receives the output of the previous one.
 */
export type SignerRequestTransformFn = (request: JsonRpcRequest) => JsonRpcRequest;
/**
 * A permission scope identifies a method and optionally additional
 * constraints (e.g. target canister IDs for delegations).
 * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_25_signer_interaction_standard.md
 */
export type PermissionScope = {
    method: string;
} & Record<string, unknown>;
/**
 * The state of a permission scope as reported by the signer.
 * - `granted` — the relying party may call the method without further approval.
 * - `denied` — the signer will reject calls to the method.
 * - `ask_on_use` — the signer will prompt the user when the method is called.
 */
export type PermissionState = 'denied' | 'ask_on_use' | 'granted';
/**
 * A standard supported by the signer, as returned by
 * {@link Signer.getSupportedStandards}. The `name` field contains
 * the ICRC standard identifier (e.g. `"ICRC-27"`) and `url` points
 * to the specification.
 */
export interface SupportedStandard {
    name: string;
    url: string;
}
/**
 * Error thrown when a signer returns a JSON-RPC error response
 * or when a transport-level failure occurs.
 */
export declare class SignerError extends Error {
    /** The JSON-RPC error code. */
    code: number;
    /** Optional additional error data from the signer. */
    data?: JsonRpcError['data'];
    constructor(error: JsonRpcError, options?: ErrorOptions);
}
/** Options for creating a {@link Signer} instance. */
export interface SignerOptions<T extends Transport> {
    /** The transport used to communicate with the signer. */
    transport: T;
    /**
     * Automatically close the transport channel after a response is received.
     * @default true
     */
    autoCloseTransportChannel?: boolean;
    /**
     * Delay in milliseconds before auto-closing the transport channel.
     * @default 200
     */
    closeTransportChannelAfter?: number;
    /**
     * Source of random UUIDs for JSON-RPC request IDs.
     * @default globalThis.crypto
     */
    crypto?: Pick<Crypto, 'randomUUID'>;
    /**
     * Additional transform functions applied to each outgoing JSON-RPC request,
     * can be used to e.g. add additional params to every request as seen in ICRC-95.
     * Transforms are applied in order; each receives the output of the previous one.
     */
    transforms?: SignerRequestTransformFn[];
    /**
     * Derivation origin for ICRC-95 identity derivation.
     * When set, all requests include an `icrc95DerivationOrigin` param.
     * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_95_derivationorigin.md
     */
    derivationOrigin?: string;
}
/**
 * Client for interacting with an ICRC-25 compliant signer.
 *
 * Signers are applications that hold private keys and can sign messages
 * on behalf of a user. They communicate over a {@link Transport} using
 * JSON-RPC 2.0 messages as defined by the ICRC-25 standard.
 * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_25_signer_interaction_standard.md
 * @example
 * ```ts
 * import { Signer } from "@icp-sdk/signer";
 * import { PostMessageTransport } from "@icp-sdk/signer/web";
 *
 * const transport = new PostMessageTransport({ url: "https://oisy.com/sign" });
 * const signer = new Signer({ transport });
 *
 * const standards = await signer.getSupportedStandards();
 * const accounts = await signer.getAccounts();
 * ```
 */
export declare class Signer<T extends Transport = Transport> {
    #private;
    constructor(options: SignerOptions<T>);
    /** The transport used to communicate with the signer. */
    get transport(): T;
    /**
     * Whether the transport channel auto-closes after a response is received.
     * Can be toggled at runtime, which is useful for multi-step flows that
     * need to await async work between requests without losing the channel.
     * Setting this to `false` also cancels any auto-close already scheduled
     * by a prior response.
     */
    get autoCloseTransportChannel(): boolean;
    set autoCloseTransportChannel(value: boolean);
    /**
     * Opens a communication channel with the signer.
     * Reuses an existing open channel if available.
     */
    openChannel(): Promise<Channel>;
    /** Closes the current communication channel, if open. */
    closeChannel(): Promise<void>;
    /**
     * Sends a JSON-RPC request over the transport channel.
     * @param request - The JSON-RPC request to send.
     */
    sendRequest(request: JsonRpcRequest): Promise<JsonRpcResponse>;
    /**
     * Queries which ICRC standards the signer supports.
     * Use this to determine signer capabilities before calling other methods.
     * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_25_signer_interaction_standard.md
     */
    getSupportedStandards(): Promise<SupportedStandard[]>;
    /**
     * Requests the signer to grant permission for the given scopes.
     * The signer may prompt the user for approval.
     * @param scopes - The permission scopes to request.
     * @returns The current state of each requested scope after the user's decision.
     */
    requestPermissions(scopes: PermissionScope[]): Promise<Array<{
        scope: PermissionScope;
        state: PermissionState;
    }>>;
    /**
     * Queries the current state of all permission scopes.
     * @returns The current permission state for each scope the signer supports.
     */
    getPermissions(): Promise<Array<{
        scope: PermissionScope;
        state: PermissionState;
    }>>;
    /**
     * Requests the accounts managed by the signer.
     * Each account has an owner {@link Principal} and an optional 32-byte subaccount.
     *
     * Requires the `icrc27_accounts` permission scope.
     * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_27_accounts.md
     */
    getAccounts(): Promise<Array<{
        owner: Principal;
        subaccount?: Uint8Array;
    }>>;
    /**
     * Requests a delegation chain from the signer for session-based authentication.
     * This allows the relying party to sign canister calls without requiring
     * user approval for each individual call.
     * @param params - The delegation request parameters.
     * @param params.publicKey - The session's public key to delegate to.
     * @param params.targets - Optional canister IDs to restrict the delegation to.
     *   When provided, the signer creates an account delegation; otherwise a
     *   relying party delegation.
     * @param params.maxTimeToLive - Optional maximum delegation lifetime in nanoseconds.
     * @returns A {@link DelegationChain} that can be used with `DelegationIdentity`.
     * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_34_delegation.md
     */
    requestDelegation(params: {
        publicKey: PublicKey;
        targets?: Principal[];
        maxTimeToLive?: bigint;
    }): Promise<DelegationChain>;
    /**
     * Requests the signer to execute a canister call on behalf of the user.
     * The signer will prompt the user for approval before signing and
     * submitting the call to the Internet Computer.
     * @param params - The canister call parameters.
     * @param params.canisterId - The target canister.
     * @param params.sender - The principal executing the call.
     * @param params.method - The canister method to invoke.
     * @param params.arg - The Candid-encoded call arguments.
     * @param params.nonce - Optional nonce (max 32 bytes) for replay protection.
     * @returns The CBOR-encoded content map and certificate from the IC,
     *   which can be used to verify the call's execution.
     * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_49_call_canister.md
     */
    callCanister(params: {
        canisterId: Principal;
        sender: Principal;
        method: string;
        arg: Uint8Array;
        nonce?: Uint8Array;
    }): Promise<{
        contentMap: Uint8Array;
        certificate: Uint8Array;
    }>;
}