/** Input shared by the optional chain-specific SIWx verifier entry points. */
interface SignInVerificationInput {
    address: string;
    message: string;
    signature: string;
    chainId?: string;
}

/**
 * CAIP-122 — Sign-In With X (SIWx)
 *
 * References:
 *   - CAIP-122: https://standards.chainagnostic.org/CAIPs/caip-122
 *   - EIP-4361 (SIWE): https://eips.ethereum.org/EIPS/eip-4361
 */
/**
 * Chain-agnostic SIWx message parameters.
 */
interface SiwxParams {
    /** RFC 4501 URI identifying the originating domain */
    domain: string;
    /** Blockchain address performing the sign-in */
    address: string;
    /** Human-readable statement (optional) */
    statement?: string;
    /** RFC 3986 URI identifying the relying party */
    uri: string;
    /** Current version of the SIWx message (default: 1) */
    version?: number;
    /** CAIP-2 chain ID (e.g. eip155:1, solana:4sGjMW1s) */
    chainId: string;
    /** Randomly generated nonce (recommended 8+ chars alphanumeric) */
    nonce: string;
    /** ISO 8601 datetime string of issuance */
    issuedAt?: string;
    /** ISO 8601 datetime string of expiry (optional) */
    expirationTime?: string;
    /** Timestamp after which the message is no longer valid (optional) */
    notBefore?: string;
    /** Optional URIs for resources the identity wishes to access */
    resources?: string[];
    /** CAIP-74 request ID (optional, for linking to a specific RPC call) */
    requestId?: string;
    /** Optional blockchain display name (e.g. "Ethereum", "Solana") */
    blockchain?: string;
}
/**
 * Result of signing a SIWx message.
 */
interface SiwxResult {
    /** The signed message */
    message: SiwxMessage;
    /** The cryptographic signature */
    signature: string;
}
/**
 * Parsed SIWx message after serialization/deserialization.
 */
interface SiwxMessage {
    /** Raw original message text */
    raw: string;
    domain: string;
    address: string;
    statement: string | null;
    uri: string;
    version: number;
    chainId: string;
    nonce: string;
    issuedAt: string | null;
    expirationTime: string | null;
    notBefore: string | null;
    resources: string[];
    requestId: string | null;
    /** Blockchain display name parsed from the message */
    blockchain: string;
}
/**
 * Namespace identifiers for supported chains.
 */
type ChainNamespace = "eip155" | "solana" | "xrpl";
/**
 * Verification result after recovering the signer from a SIWx message.
 */
interface SiwxVerificationResult {
    /** The recovered address */
    address: string;
    /** Whether the signature is valid */
    isValid: boolean;
    /** Error message if verification failed */
    error?: string;
}

/**
 * CAIP-122 Message Format — Sign-In With X
 *
 * Creates and parses SIWx messages according to CAIP-122.
 * Supports all chain namespaces (EVM, Solana, XRPL).
 *
 * References:
 *   - CAIP-122: https://standards.chainagnostic.org/CAIPs/caip-122
 *   - EIP-4361: https://eips.ethereum.org/EIPS/eip-4361
 */

/**
 * Default nonce length for SIWx messages.
 */
declare const DEFAULT_NONCE_LENGTH = 16;
/**
 * Current version of the SIWx message format.
 */
declare const SIWX_VERSION = 1;
/**
 * Derive a human-readable blockchain name from a CAIP-2 chain ID.
 *
 * Reference: Reown AppKit's `getNetworkNameByCaipNetworkId`
 * maps CAIP-2 namespace → display name.
 */
declare function getBlockchainName(chainId: string): string;
/**
 * Create a CAIP-122 formatted SIWx message string.
 * The returned string is what the user signs.
 */
declare function createSiwxMessage(params: SiwxParams): string;
/**
 * Parse a CAIP-122 SIWx message string into its structured components.
 * Returns null if parsing fails.
 */
declare function parseSiwxMessage(raw: string): SiwxMessage | null;
/**
 * Type guard to check if an object is a valid SiwxMessage.
 */
declare function isSiwxMessage(obj: unknown): obj is SiwxMessage;

/**
 * SIWx Session Storage
 *
 * Provides storage adapters for SiwxSession persistence.
 * Supports localStorage and in-memory storage with auto-cleanup of expired sessions.
 */

/**
 * Storage interface for SiwxSession persistence.
 * All operations are async for compatibility with diverse storage backends.
 */
interface SiwxSessionStorage {
    /** Retrieve a stored session, or null if none exists / expired */
    get(): Promise<SiwxSession | null>;
    /** Persist a session */
    set(session: SiwxSession): Promise<void>;
    /** Remove the stored session */
    remove(): Promise<void>;
    /** Check whether a session exists in storage */
    has(): Promise<boolean>;
    /** Clear all sessions managed by this adapter */
    clear(): Promise<void>;
}
/**
 * Creates a SiwxSessionStorage backed by window.localStorage.
 * On `get()`, if the stored session is expired it will be automatically removed.
 */
declare function createLocalStorageSiwxSessionStorage(key: string): SiwxSessionStorage;
/**
 * Creates a SiwxSessionStorage backed by an in-memory Map.
 * Used primarily for testing and server-side environments.
 * On `get()`, expired sessions are automatically evicted.
 */
declare function createMemorySiwxSessionStorage(key: string): SiwxSessionStorage;
/**
 * Auto-cleanup scoped to a specific session — checks the session's expiry
 * and returns null if expired. Used by consumers that hold a session reference
 * and want a lightweight check without re-reading storage.
 */
declare function checkSessionExpired(session: SiwxSession | null): boolean;

/**
 * SIWx Session Management
 *
 * Provides a framework-agnostic SiwxSessionManager for creating, refreshing,
 * and managing authenticated wallet sessions built on CAIP-122 (SIWx) messages.
 *
 * Features:
 *  - Session creation from SIWx signed messages
 *  - Session expiry (configurable, default 24h)
 *  - Session refresh (re-signs with updated expiry via the provided signer)
 *  - Callback-based event system (onSessionChange, onExpiry)
 *  - Storage-agnostic (accepts any SiwxSessionStorage implementation)
 *  - Chain-agnostic (supports EVM, Solana, XRPL, etc.)
 *
 * Usage:
 * ```ts
 * import { SiwxSessionManager, createLocalStorageSiwxSessionStorage } from "@naculus/siwx";
 *
 * const mgr = new SiwxSessionManager({
 *   storage: createLocalStorageSiwxSessionStorage("naculus_siwx_session"),
 *   signMessage: async ({ message, address }) => wallet.signMessage(message),
 * });
 *
 * const session = await mgr.signIn({
 *   chainId: "eip155:1",
 *   domain: "example.com",
 *   address: "0x...",
 *   uri: "https://example.com/login",
 *   nonce: "abc123",
 * });
 * ```
 */

/**
 * A single authenticated SIWx session.
 */
interface SiwxSession {
    /** Unique session identifier */
    id: string;
    /** CAIP-2 chain ID (e.g. "eip155:1", "solana:4sGjMW1s") */
    chainId: string;
    /** Blockchain address of the authenticated user */
    address: string;
    /** Domain where the session was established */
    domain: string;
    /** The parsed SIWx message */
    message: SiwxMessage;
    /** Cryptographic signature produced by the wallet */
    signature: string;
    /** ISO 8601 timestamp of session creation */
    issuedAt: string;
    /** ISO 8601 timestamp of session expiry, or null if never expires */
    expiresAt: string | null;
    /** ISO 8601 timestamp of last refresh, or null if never refreshed */
    refreshedAt: string | null;
    /** Optional metadata attached to the session */
    metadata?: Record<string, unknown>;
}
/**
 * Parameters for establishing a new SIWx session via signIn().
 */
interface SiwxSignInParams {
    /** CAIP-2 chain ID */
    chainId: string;
    /** Blockchain address performing the sign-in */
    address: string;
    /** Originating domain (default: window.location.host in browser) */
    domain?: string;
    /** RFC 3986 URI identifying the relying party (default: window.location.origin) */
    uri?: string;
    /** Human-readable statement (optional) */
    statement?: string;
    /** Random nonce (auto-generated if omitted) */
    nonce?: string;
    /** Session lifetime in seconds (default: 86400 = 24 hours). Set to 0 for no expiry. */
    expirySeconds?: number;
    /** CAIP-74 request ID (optional) */
    requestId?: string;
    /** URIs of resources the identity wishes to access (optional) */
    resources?: string[];
    /** Optional blockchain display name override (e.g. "Ethereum") */
    blockchain?: string;
}
/**
 * Parameters for refreshing an existing session.
 */
interface SiwxRefreshParams {
    /** Session lifetime in seconds for the refreshed session (default: same as original) */
    expirySeconds?: number;
}
/**
 * Callback invoked when the active session changes (sign-in, sign-out, refresh).
 */
type SessionChangeCallback = (session: SiwxSession | null) => void;
/**
 * Callback invoked when the active session expires.
 */
type SessionExpiryCallback = (session: SiwxSession) => void;
/** Default session lifetime: 24 hours in seconds */
declare const DEFAULT_SESSION_EXPIRY_SECONDS = 86400;
/** Storage key for memory/localStorage usage */
declare const DEFAULT_SESSION_STORAGE_KEY = "naculus_siwx_session";
interface SiwxSessionManagerOptions {
    /** Storage backend for persisting the session */
    storage: SiwxSessionStorage;
    /**
     * Message signing function.
     * The signMessage function receives the raw SIWx message string and the
     * address to sign as, and must return the cryptographic signature.
     */
    signMessage: (params: {
        message: string;
        address: string;
    }) => string | Promise<string>;
    /** Default expiry in seconds (default: 86400 = 24h) */
    defaultExpirySeconds?: number;
    /** Default domain (default: auto-detected from window.location) */
    defaultDomain?: string;
    /** Default URI (default: auto-detected from window.location) */
    defaultUri?: string;
}
declare class SiwxSessionManager {
    private readonly storage;
    private readonly signMessage;
    private readonly defaultExpirySeconds;
    private readonly defaultDomain;
    private readonly defaultUri;
    private session;
    private sessionChangeCallbacks;
    private expiryCallbacks;
    private expiryTimer;
    /**
     * Lifecycle generation. signOut and every signIn increment it; an async
     * signIn, refresh or restore captures it before awaiting and discards its
     * result if it changed, so an obsolete completion never republishes or
     * persists an identity after a newer lifecycle decision.
     */
    private generation;
    constructor(options: SiwxSessionManagerOptions);
    /**
     * Create a new authenticated session.
     *
     * 1. Builds a CAIP-122 message using the provided chain/address parameters.
     * 2. Signs it via the configured signMessage function.
     * 3. Persists the resulting session to storage.
     * 4. Fires session-change callbacks.
     * 5. Schedules an expiry watchdog timer.
     *
     * Returns the fully-populated SiwxSession.
     */
    signIn(params: SiwxSignInParams): Promise<SiwxSession>;
    /**
     * Sign out: clear the session from storage and memory, fire callbacks.
     * Any signIn, refresh or restore still pending is discarded.
     */
    signOut(): Promise<void>;
    /**
     * Refresh the current session by re-signing with a fresh expiry.
     *
     * The refresh produces a new CAIP-122 message with an updated `issuedAt`
     * and `expirationTime`, signs it via the same signer, and persists the
     * updated session.
     *
     * If no session exists, throws an error.
     */
    refresh(params?: SiwxRefreshParams): Promise<SiwxSession>;
    /**
     * Get the current session from memory (not storage).
     * Returns null if no session is active or if the cached session has expired.
     */
    getSession(): SiwxSession | null;
    /**
     * Reload the session from storage, useful after page refresh.
     * Fires session-change callbacks if the restored state differs.
     */
    restore(): Promise<SiwxSession | null>;
    /**
     * Whether the current session has expired.
     * Returns true if no session is active or if the session's expiresAt is in the past.
     */
    isExpired(): boolean;
    /**
     * Milliseconds until the current session expires, or null if no session / no expiry.
     */
    getTimeUntilExpiry(): number | null;
    /**
     * Subscribe to session changes.
     * Returns an unsubscribe function.
     */
    onSessionChange(callback: SessionChangeCallback): () => void;
    /**
     * Subscribe to session expiry events.
     * Returns an unsubscribe function.
     */
    onExpiry(callback: SessionExpiryCallback): () => void;
    /**
     * Persist a session produced by an operation that started at `generation`.
     * Throws without writing if a signIn or signOut has run since. If the
     * lifecycle changes while the write is in flight, the write is undone when
     * storage still holds exactly this session (a newer write is left alone)
     * and the operation throws, so its caller never publishes it.
     */
    private persistIfCurrent;
    private notifySessionChange;
    private notifyExpiry;
    private scheduleExpiryCheck;
    private clearExpiryTimer;
}

/**
 * SIWx Nonce Consumption Tracker
 *
 * Prevents replay attacks by tracking which nonces have already been consumed
 * during signature verification. Once a nonce is marked as consumed, any
 * subsequent verify attempt with the same nonce will fail.
 *
 * The tracker is in-memory by default. A custom storage backend can be provided
 * for server-side multi-process persistence (e.g. Redis).
 *
 * IMPORTANT: In-memory storage is ephemeral — nonces are lost on restart.
 * Production deployments with server-side verification MUST provide a
 * persistent SiwxNonceStorage backend.
 */
interface SiwxNonceStorage {
    /** Check if a nonce exists (consumed or unused) */
    has(nonce: string): Promise<boolean>;
    /** Mark a nonce as consumed */
    consume(nonce: string): Promise<void>;
    /** Check if a nonce has already been consumed */
    isConsumed(nonce: string): Promise<boolean>;
    /** Remove a nonce from tracking (e.g. after expiry) */
    remove(nonce: string): Promise<void>;
    /** Track a nonce as issued (unused) */
    issue(nonce: string): Promise<void>;
    /** Ensure a nonce was previously issued — returns true if valid */
    isIssued(nonce: string): Promise<boolean>;
    /** Atomically consume an issued, unused nonce. Returns false for invalid/replayed nonces. */
    consumeIfValid(nonce: string): Promise<boolean>;
}
/**
 * Creates an in-memory SiwxNonceStorage.
 *
 * Suitable for single-server, ephemeral use.
 * For multi-server or production deployments, provide a custom storage backend.
 */
declare function createMemoryNonceStorage(): SiwxNonceStorage;
/**
 * Override the default nonce storage with a custom backend.
 * Returns the previous storage instance.
 *
 * Example:
 * ```ts
 * import { setNonceStorage, createMemoryNonceStorage } from "@naculus/siwx";
 * setNonceStorage(createRedisNonceStorage(redisClient));
 * ```
 */
declare function setNonceStorage(storage: SiwxNonceStorage): SiwxNonceStorage;
/**
 * Reset nonce storage back to a fresh in-memory instance.
 * Returns the replaced storage instance.
 */
declare function resetNonceStorage(): SiwxNonceStorage;
/**
 * Mark a nonce as issued (tracked but not yet consumed).
 * Call this when creating a sign-in request and retain the nonce until verify.
 */
declare function issueNonce(nonce: string): Promise<void>;
/**
 * Mark a nonce as consumed (used in a successful sign-in).
 * Called automatically during verify when a nonce is accepted.
 */
declare function consumeNonce(nonce: string): Promise<void>;
/**
 * Atomically validate and consume a nonce.
 *
 * Custom backends must implement this as one datastore operation (for example
 * Redis SETNX or a SQL conditional update). Keeping the operation in the
 * storage contract prevents a verification path from reintroducing a replay
 * race by composing separate read/write calls.
 */
declare function consumeNonceIfValid(nonce: string): Promise<boolean>;
/**
 * Check whether a nonce has already been consumed.
 * Called during verify to prevent replay attacks.
 */
declare function isNonceConsumed(nonce: string): Promise<boolean>;
/**
 * Check whether a nonce was previously issued by the system.
 */
declare function isNonceIssued(nonce: string): Promise<boolean>;
/**
 * Full check: verify a nonce is valid (issued + not yet consumed).
 * This is the primary check used during verification.
 */
declare function isNonceValid(nonce: string): Promise<boolean>;
/**
 * Remove a nonce from tracking entirely.
 */
declare function removeNonce(nonce: string): Promise<void>;

/**
 * SIWx Utility Functions
 */
/**
 * Generate a cryptographically-random nonce.
 * Uses crypto.getRandomValues for browser/Node compatibility.
 * Produces an alphanumeric string of the specified length (default 16).
 */
declare function generateNonce(length?: number): string;
/**
 * Format the current time as an ISO 8601 string (UTC).
 */
declare function nowISO(): string;
/**
 * Add seconds to the current time and return an ISO 8601 string.
 */
declare function addSecondsISO(seconds: number): string;
/**
 * Parse a CAIP-2 chain ID into namespace and reference.
 * Example: "eip155:1" -> { namespace: "eip155", reference: "1" }
 */
declare function parseChainId(chainId: string): {
    namespace: string;
    reference: string;
};
/**
 * Validate the nonce grammar required by EIP-4361/CAIP-122 text messages:
 * at least eight ASCII alphanumeric characters.
 */
declare function isValidNonce(nonce: string): boolean;
/**
 * Validate that a domain is a valid RFC 4501 URI host.
 * Accepts hostnames (e.g. "example.com", "localhost") and optional port.
 */
declare function isValidDomain(domain: string): boolean;

/**
 * Contract-account signature verification: ERC-1271 and ERC-6492.
 *
 * SIWx previously verified EVM signatures by recovering an address with
 * `ecrecover`, which only answers for an externally owned account. A smart
 * account signs through its own logic, so recovery returns some unrelated
 * address and the sign-in is rejected — silently, and with no indication that
 * the account type was the problem. A counterfactual account, one whose
 * address is known but whose contract is not deployed yet, cannot be asked at
 * all until it exists; ERC-6492 exists for exactly that case.
 *
 * This module is chain-access agnostic: the caller supplies an `eth_call`
 * function, so it can be pointed at a viem client, a raw RPC, or a stub.
 */
/**
 * `bytes4(keccak256("isValidSignature(bytes32,bytes)"))`, the value ERC-1271
 * requires a contract to return when a signature is valid. Derived rather than
 * transcribed so it cannot drift from the signature it comes from.
 */
declare const ERC1271_MAGIC_VALUE = "0x1626ba7e";
/**
 * Trailing 32 bytes that mark an ERC-6492 wrapper, defined by the ERC as
 * `0x6492…6492`. Chosen by the spec to be improbable as a real signature tail.
 */
declare const ERC6492_MAGIC_SUFFIX = "6492649264926492649264926492649264926492649264926492649264926492";
/**
 * Performs an `eth_call`; returns the raw hex result.
 *
 * Omitting `to` makes a contract-creation `eth_call`, as supported by
 * standard JSON-RPC nodes. ERC-6492 uses this address-free verification form.
 */
type EthCall = (params: {
    to?: string;
    data: string;
}) => Promise<string>;
/**
 * EIP-191 personal-sign digest.
 *
 * Computed here rather than imported from viem. It is a few lines built on a
 * dependency this package already carries, and routing it through a dynamic
 * `import("viem")` made it hostage to whatever shape the consumer's bundler
 * gives the namespace object: under one resolver `hashMessage` was simply
 * absent, so contract verification failed with an error about a missing
 * function rather than about the signature.
 */
declare function hashPersonalMessage(message: string): string;
/** True when the signature carries the ERC-6492 wrapper. */
declare function isErc6492Signature(signature: string): boolean;
interface Erc6492Envelope {
    /** Factory that would deploy the account. */
    factory: string;
    /** Calldata that deploys it. */
    factoryCalldata: string;
    /** The signature the account itself produced. */
    signature: string;
}
/**
 * Unwrap `abi.encode(address factory, bytes factoryCalldata, bytes signature)`
 * followed by the magic suffix.
 *
 * @returns the envelope, or undefined when the payload is not a well-formed
 *   wrapper. Returning undefined rather than throwing lets the caller fall
 *   back to treating it as a plain signature, which is what a non-wrapped
 *   signature that happens to end in the magic bytes would be.
 */
declare function decodeErc6492Signature(signature: string): Erc6492Envelope | undefined;
/** ABI-encode `isValidSignature(bytes32 hash, bytes signature)`. */
declare function encodeIsValidSignatureCall(hash: string, signature: string): string;
/** True when an `isValidSignature` return value is the ERC-1271 magic value. */
declare function isErc1271Accepted(returnData: string): boolean;
/**
 * Verify a signature against a deployed contract account via ERC-1271.
 *
 * @returns false when the call reverts or returns anything other than the
 *   magic value. A revert is a rejection, not an error to propagate: an
 *   account that does not implement ERC-1271 has not signed anything.
 */
declare function verifyErc1271(account: string, hash: string, signature: string, call: EthCall): Promise<boolean>;

/**
 * SIWx Verification — verify SiwxMessage signatures
 *
 * This module provides chain-agnostic SIWx message verification.
 * It validates message structure, time constraints, and delegates
 * cryptographic signature recovery to a user-provided callback.
 *
 * Chain-specific verifier factories are provided for convenience:
 *   - createEVMVerifier()       — uses viem recoverMessageAddress
 *   - createSolanaVerifier()    — uses tweetnacl + bs58
 *   - createXRPLVerifier()      — uses ripple-keypairs
 *
 * Usage:
 * ```ts
 * import { verifySiwxMessage, createEVMVerifier } from "@naculus/siwx";
 *
 * const result = await verifySiwxMessage({
 *   raw: rawMessage,
 *   signature: "0x...",
 *   recoverAddress: createEVMVerifier(),
 *   expectedAddress: "0x...",
 *   domain: "example.com",
 *   nonce: "abc123",
 * });
 * ```
 */

/**
 * Parameters for verifySiwxMessage.
 */
interface VerifySiwxMessageParams {
    /** The raw SIWx message string that was signed */
    raw: string;
    /** The cryptographic signature (hex-encoded for EVM, base58 for Solana) */
    signature: string;
    /**
     * Callback that recovers the signer address from a message + signature.
     * The `message` passed here is the raw message string (not the Ethereum-prefixed one;
     * the verifier is responsible for applying any required prefix/hash).
     */
    recoverAddress: (params: {
        message: string;
        signature: string;
        /** Public key/address needed by non-recoverable signature schemes. */
        publicKey?: string;
    }) => string | boolean | Promise<string | boolean>;
    /** Expected signer address. If provided, verification checks address match. */
    expectedAddress?: string;
    /** Public key for schemes such as Solana and XRPL that cannot recover it. */
    publicKey?: string;
    /** Expected domain. If provided, verification checks domain match. */
    domain?: string;
    /** Expected nonce. If provided, verification checks nonce match. */
    nonce?: string;
    /**
     * Reference timestamp (ISO 8601) for checking expirationTime/notBefore.
     * Defaults to current time.
     */
    timestamp?: string;
}
/**
 * Additional options controlling validation strictness.
 */
interface VerifyOptions {
    /**
     * Verify a message without binding it to a domain.
     *
     * Domain binding is what stops a signature harvested on a phishing site
     * from being replayed against the real one: the signature is genuine and
     * the nonce is genuine, and the domain line is the only field that says who
     * the user meant to sign in to. Verification therefore requires
     * `params.domain` by default, and opting out has to be spelled out.
     *
     * Legitimate uses are narrow — inspecting a message whose origin is already
     * established by other means, or tests. Never set it on a login path.
     */
    allowUnboundDomain?: boolean;
    /** When true, messages without expirationTime are rejected (default: false) */
    requireExpirationTime?: boolean;
    /** When true, expirationTime check is skipped (default: false) */
    skipExpirationCheck?: boolean;
    /** When true, notBefore check is skipped (default: false) */
    skipNotBeforeCheck?: boolean;
}
/**
 * Verify a SIWx message and its cryptographic signature.
 *
 * Steps:
 * 1. Parse the raw message
 * 2. Validate structural integrity
 * 3. Check constraints (domain is required, then nonce, expiry, notBefore)
 * 4. Recover the signer address from the signature
 * 5. Compare recovered address with expected address (if provided)
 *
 * Returns a SiwxVerificationResult with the recovered address and validity flag.
 */
declare function verifySiwxMessage(params: VerifySiwxMessageParams, options?: VerifyOptions): Promise<SiwxVerificationResult>;
/**
 * Create an EVM (EIP-4361 SIWE) verifier using viem's recoverMessageAddress.
 *
 * Requires `viem` to be installed.
 * Throws if viem cannot be imported.
 */
interface EVMVerifierOptions {
    /**
     * Performs an `eth_call`. Supplying it enables contract-account
     * verification (ERC-1271 and ERC-6492, including counterfactual accounts).
     * Without it only externally owned accounts can be verified, because
     * `ecrecover` has nothing to say about a contract signature.
     */
    call?: EthCall;
    /** Returns the deployed bytecode at an address, or "0x" when there is none. */
    getCode?: (address: string) => Promise<string>;
}
declare function createEVMVerifier(options?: EVMVerifierOptions): (params: {
    message: string;
    signature: string;
    publicKey?: string;
}) => Promise<string | boolean>;
/**
 * Create a Solana (SIWS) verifier using tweetnacl and bs58.
 *
 * Both ship as dependencies of this package; a consumer does not install them
 * separately.
 *
 * Only the imports are guarded. Decoding and verification failures belong to
 * the caller's input and propagate unchanged: an invalid base58 string throws
 * `Non-base58 character` from bs58, and a wrong-length signature or key throws
 * `bad signature size` / `bad public key size` from tweetnacl. Translating
 * those into "install the package" was wrong — it named a cause that was never
 * true and sent the reader looking in the wrong place.
 */
declare function createSolanaVerifier(): (params: {
    message: string;
    signature: string;
    publicKey?: string;
}) => Promise<boolean>;
/**
 * Create an XRPL verifier using ripple-keypairs.
 *
 * `ripple-keypairs` is a runtime dependency of this package. Import failures
 * therefore indicate a broken module-resolution/bundling setup, while invalid
 * signatures remain ordinary input failures and are not rewritten as install
 * errors.
 */
declare function createXRPLVerifier(): (params: {
    message: string;
    signature: string;
    publicKey?: string;
}) => Promise<string | boolean>;

/**
 * @naculus/siwx — CAIP-122 Sign-In With X
 *
 * Chain-agnostic SIWx message creation, parsing, verification, and utilities.
 * Supports EVM (EIP-4361), Solana, XRPL, and other CAIP-122 compliant chains.
 */

/**
 * Load optional chain verifiers only when they are used. Keeping these behind
 * an import boundary means consumers can import the core SIWx API without
 * installing every chain's optional cryptography package.
 */
declare function verifyCosmwasmSignInMessage(input: SignInVerificationInput): Promise<boolean>;
declare function verifyPolkadotSignInMessage(input: SignInVerificationInput): Promise<boolean>;
declare function verifyStarknetSignInMessage(input: SignInVerificationInput): Promise<boolean>;

export { type ChainNamespace, DEFAULT_NONCE_LENGTH, DEFAULT_SESSION_EXPIRY_SECONDS, DEFAULT_SESSION_STORAGE_KEY, ERC1271_MAGIC_VALUE, ERC6492_MAGIC_SUFFIX, type Erc6492Envelope, type EthCall, SIWX_VERSION, type SessionChangeCallback, type SessionExpiryCallback, type SiwxMessage, type SiwxNonceStorage, type SiwxParams, type SiwxRefreshParams, type SiwxResult, type SiwxSession, SiwxSessionManager, type SiwxSessionManagerOptions, type SiwxSessionStorage, type SiwxSignInParams, type SiwxVerificationResult, type VerifyOptions, type VerifySiwxMessageParams, addSecondsISO, checkSessionExpired, consumeNonce, consumeNonceIfValid, createEVMVerifier, createLocalStorageSiwxSessionStorage, createMemoryNonceStorage, createMemorySiwxSessionStorage, createSiwxMessage, createSolanaVerifier, createXRPLVerifier, decodeErc6492Signature, encodeIsValidSignatureCall, generateNonce, getBlockchainName, hashPersonalMessage, isErc1271Accepted, isErc6492Signature, isNonceConsumed, isNonceIssued, isNonceValid, isSiwxMessage, isValidDomain, isValidNonce, issueNonce, nowISO, parseChainId, parseSiwxMessage, removeNonce, resetNonceStorage, setNonceStorage, verifyCosmwasmSignInMessage, verifyErc1271, verifyPolkadotSignInMessage, verifySiwxMessage, verifyStarknetSignInMessage };