import type { AccountConnectionStatus as AccountConnectionStatusCodec, AccountSelector, CodecType, LegacyAccount as LegacyAccountCodec, ProductAccountId as ProductAccountIdCodec, RegisteredRingVrfKey as RegisteredRingVrfKeyCodec, RingVrfKeyDisclosure as RingVrfKeyDisclosureCodec, RingVrfKeyHandle as RingVrfKeyHandleCodec, Subscription, Transport, VrfTranscriptItem as VrfTranscriptItemCodec } from '@novasamatech/host-api';
import { RingLocation } from '@novasamatech/host-api';
import type { SignerTxCreator } from 'polkadot-api/tx-creator';
export type { AccountSelector } from '@novasamatech/host-api';
export type ProductAccountId = CodecType<typeof ProductAccountIdCodec>;
export type ProductAccount = {
    dotNsIdentifier: string;
    /**
     * Account selector within the product subtree (RFC 0022): a plain index or a
     * raw 32-byte index.
     */
    derivationIndex: AccountSelector;
    publicKey: Uint8Array;
};
/**
 * Product-scoped proof context (RFC 0004, amended by RFC 0022): the product id
 * plus a selector that expands to the same 32-byte derivation index as a
 * product account's.
 */
export type ProofContext = [productId: string, suffix: AccountSelector];
/**
 * Public name of a registered ring VRF key (RFC-0024).
 *
 * Deliberately kept in wire form: the index is the owning product's
 * implementation detail, so a handle obtained from {@link
 * createAccountsProvider}'s `listRingVrfKeys` must be passed through opaquely.
 * **Never hardcode another product's index** — select by declared ring instead;
 * hardcoding breaks the moment the owner rotates or adds a key. Use
 * {@link ringVrfKeyHandle} to name a key your own product owns.
 */
export type RingVrfKeyHandle = CodecType<typeof RingVrfKeyHandleCodec>;
/** A ring VRF key registry entry (RFC-0024). */
export type RegisteredRingVrfKey = CodecType<typeof RegisteredRingVrfKeyCodec>;
/** How much of a registry entry to ask for: `'Anonymized'` or `'PublicKey'` (RFC-0024). */
export type RingVrfKeyDisclosure = CodecType<typeof RingVrfKeyDisclosureCodec>;
/**
 * Builds a {@link RingVrfKeyHandle} for a key inside `owner`'s ring VRF domain.
 *
 * Intended for naming your *own* keys — the ones you passed to
 * `registerRingVrfKey`. For a foreign key, take the handle from
 * `listRingVrfKeys` instead of constructing one.
 */
export declare function ringVrfKeyHandle(owner: string, index: AccountSelector): RingVrfKeyHandle;
export type LegacyAccount = CodecType<typeof LegacyAccountCodec>;
export type AccountConnectionStatus = CodecType<typeof AccountConnectionStatusCodec>;
/** One `transcript.append_message(label, value)` call replayed by the host (RFC-0023). */
export type VrfTranscriptItem = CodecType<typeof VrfTranscriptItemCodec>;
export declare const createAccountsProvider: (transport?: Transport) => {
    getUserId(): import("neverthrow").ResultAsync<{
        primaryUsername: string;
    }, import("@novasamatech/scale").CodecError<undefined, "GetUserIdErr::NotConnected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "GetUserIdErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetUserIdErr::PermissionDenied">>;
    requestLogin(reason?: string): import("neverthrow").ResultAsync<"success" | "alreadyConnected" | "rejected", import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "LoginErr::Unknown">>;
    getProductAccount(dotNsIdentifier: string, derivationIndex?: AccountSelector): import("neverthrow").ResultAsync<{
        publicKey: Uint8Array<ArrayBufferLike>;
        dotNsIdentifier: string;
        derivationIndex: AccountSelector;
    }, import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::Rejected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::DomainNotValid"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RequestCredentialsErr::Unknown">>;
    /**
     * Registers a ring VRF key this product owns, declaring the ring it is
     * intended for (RFC-0024).
     *
     * Ownership is the calling product, never a parameter, so this is
     * permissionless and prompt-free. Registering the same `index` for another
     * `ring` extends the existing entry rather than creating a second one.
     *
     * Registration declares *intent*, not membership: it says "this is the key
     * I will use for that ring", not "the user is a person". Membership is
     * still discovered only by attempting a proof.
     */
    registerRingVrfKey(index: AccountSelector, ring: CodecType<typeof RingLocation>): import("neverthrow").ResultAsync<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RegisterRingVrfKeyErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::RingNotFound">>;
    /**
     * Lists the ring VRF registry entries owned by `owner` — this product or
     * another one (RFC-0024).
     *
     * Listing your own keys is permissionless; a foreign `owner` needs a grant
     * or produces a user prompt. `'PublicKey'` disclosure additionally returns
     * the member public key, which is linkable across every ring it appears in
     * and so is permissioned cross-product.
     *
     * Select the entry you want by the rings it declares, never by index.
     */
    listRingVrfKeys(owner: string, disclosure?: RingVrfKeyDisclosure): import("neverthrow").ResultAsync<{
        handle: [string, {
            tag: "Index";
            value: number;
        } | {
            tag: "Raw";
            value: Uint8Array<ArrayBufferLike>;
        }];
        rings: {
            chainId: `0x${string}`;
            junctions: ({
                tag: "PalletInstance";
                value: number;
            } | {
                tag: "CollectionId";
                value: Uint8Array<ArrayBufferLike>;
            })[];
        }[];
        publicKey: Uint8Array<ArrayBufferLike> | undefined;
    }[], import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "ListRingVrfKeysErr::Unknown">>;
    /**
     * Reads the contextual alias `keyHandle` resolves to under `context` in `ring`
     * (RFC-0004, amended by RFC-0024).
     *
     * `ring` stays explicit even though the handle carries its declared rings,
     * because a key may be registered for several and the caller must say which
     * the alias is against; the host fails with `KeyNotInRing` otherwise.
     *
     * Check `ringRevision` on each use of the resulting alias and renew when it
     * has moved — nothing else watches for it.
     */
    getContextualAlias(keyHandle: RingVrfKeyHandle, context: ProofContext, ring: CodecType<typeof RingLocation>): import("neverthrow").ResultAsync<{
        context: Uint8Array<ArrayBufferLike>;
        alias: Uint8Array<ArrayBufferLike>;
    }, import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "GetAliasErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotInRing">>;
    getLegacyAccounts(): import("neverthrow").ResultAsync<{
        publicKey: Uint8Array<ArrayBufferLike>;
        name: string | undefined;
    }[], import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::Rejected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::DomainNotValid"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RequestCredentialsErr::Unknown">>;
    /**
     * Produces an anonymous ring VRF proof with `keyHandle` under `context` in
     * `ring` (RFC-0004, amended by RFC-0024).
     *
     * A proof is a bearer token for its context's alias, so a *foreign*
     * `keyHandle` is admitted only when the owning product allowlisted this one
     * in its manifest — there is no user-prompt fallback, and the host returns
     * `NotAllowlisted` otherwise.
     */
    createRingVRFProof(keyHandle: RingVrfKeyHandle, context: ProofContext, ring: CodecType<typeof RingLocation>, message: Uint8Array): import("neverthrow").ResultAsync<{
        proof: Uint8Array<ArrayBufferLike>;
        contextualAlias: {
            context: Uint8Array<ArrayBufferLike>;
            alias: Uint8Array<ArrayBufferLike>;
        };
        ringIndex: number;
        ringRevision: number;
    }, import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "CreateProofErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotInRing"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotAllowlisted">>;
    /**
     * Signs `message` with the ring VRF member key itself, producing an ordinary
     * signature rather than an anonymous ring proof (RFC-0024).
     *
     * Takes no context and no ring: it derives no alias and proves no
     * membership. A verifier needs the member public key, so the signature is
     * **linkable** to every other use of that key — including every ring the key
     * is a member of.
     *
     * Like `createRingVRFProof`, a foreign `keyHandle` requires the owner's
     * manifest allowlist and has no prompt fallback.
     */
    ringVrfSign(keyHandle: RingVrfKeyHandle, message: Uint8Array): import("neverthrow").ResultAsync<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RingVrfSignErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotAllowlisted">>;
    /**
     * Produces an sr25519 (schnorrkel) VRF signature from a product account (RFC-0023).
     *
     * The host replays `transcriptLabel` and `items` into a Merlin transcript verbatim —
     * `Transcript::new(transcriptLabel)` then one `append_message(label, value)` per item,
     * in order — and signs it. Callers that need a `signer` item must pass their own public
     * key (from `getProductAccount`); the host never injects it.
     */
    signVrf(dotNsIdentifier: string, derivationIndex: AccountSelector, transcriptLabel: Uint8Array, items: VrfTranscriptItem[]): import("neverthrow").ResultAsync<{
        preOutput: Uint8Array<ArrayBufferLike>;
        proof: Uint8Array<ArrayBufferLike>;
    }, import("@novasamatech/scale").CodecError<undefined, "SignVrfErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "SignVrfErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "SignVrfErr::Unknown">>;
    /**
     * Builds a `TxCreator` (polkadot-api v3) that delegates to the host via
     * `host_create_transaction`. The host keeps ownership of extension inference
     * and signing; the creator maps the v3 `TxPayloadV1` onto the host codec.
     *
     * `publicKey` is exposed synchronously on the returned object and is taken
     * from `account`, so no up-front `host_account_get` is needed.
     */
    getProductAccountSigner(account: ProductAccount, signerType?: "signPayload" | "createTransaction"): SignerTxCreator;
    subscribeAccountConnectionStatus(callback: (status: AccountConnectionStatus) => void): Subscription<void>;
    getLegacyAccountSigner(account: LegacyAccount): SignerTxCreator;
};
export declare const accounts: {
    getUserId(): import("neverthrow").ResultAsync<{
        primaryUsername: string;
    }, import("@novasamatech/scale").CodecError<undefined, "GetUserIdErr::NotConnected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "GetUserIdErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetUserIdErr::PermissionDenied">>;
    requestLogin(reason?: string): import("neverthrow").ResultAsync<"success" | "alreadyConnected" | "rejected", import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "LoginErr::Unknown">>;
    getProductAccount(dotNsIdentifier: string, derivationIndex?: AccountSelector): import("neverthrow").ResultAsync<{
        publicKey: Uint8Array<ArrayBufferLike>;
        dotNsIdentifier: string;
        derivationIndex: AccountSelector;
    }, import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::Rejected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::DomainNotValid"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RequestCredentialsErr::Unknown">>;
    /**
     * Registers a ring VRF key this product owns, declaring the ring it is
     * intended for (RFC-0024).
     *
     * Ownership is the calling product, never a parameter, so this is
     * permissionless and prompt-free. Registering the same `index` for another
     * `ring` extends the existing entry rather than creating a second one.
     *
     * Registration declares *intent*, not membership: it says "this is the key
     * I will use for that ring", not "the user is a person". Membership is
     * still discovered only by attempting a proof.
     */
    registerRingVrfKey(index: AccountSelector, ring: CodecType<typeof RingLocation>): import("neverthrow").ResultAsync<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RegisterRingVrfKeyErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::RingNotFound">>;
    /**
     * Lists the ring VRF registry entries owned by `owner` — this product or
     * another one (RFC-0024).
     *
     * Listing your own keys is permissionless; a foreign `owner` needs a grant
     * or produces a user prompt. `'PublicKey'` disclosure additionally returns
     * the member public key, which is linkable across every ring it appears in
     * and so is permissioned cross-product.
     *
     * Select the entry you want by the rings it declares, never by index.
     */
    listRingVrfKeys(owner: string, disclosure?: RingVrfKeyDisclosure): import("neverthrow").ResultAsync<{
        handle: [string, {
            tag: "Index";
            value: number;
        } | {
            tag: "Raw";
            value: Uint8Array<ArrayBufferLike>;
        }];
        rings: {
            chainId: `0x${string}`;
            junctions: ({
                tag: "PalletInstance";
                value: number;
            } | {
                tag: "CollectionId";
                value: Uint8Array<ArrayBufferLike>;
            })[];
        }[];
        publicKey: Uint8Array<ArrayBufferLike> | undefined;
    }[], import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "ListRingVrfKeysErr::Unknown">>;
    /**
     * Reads the contextual alias `keyHandle` resolves to under `context` in `ring`
     * (RFC-0004, amended by RFC-0024).
     *
     * `ring` stays explicit even though the handle carries its declared rings,
     * because a key may be registered for several and the caller must say which
     * the alias is against; the host fails with `KeyNotInRing` otherwise.
     *
     * Check `ringRevision` on each use of the resulting alias and renew when it
     * has moved — nothing else watches for it.
     */
    getContextualAlias(keyHandle: RingVrfKeyHandle, context: ProofContext, ring: CodecType<typeof RingLocation>): import("neverthrow").ResultAsync<{
        context: Uint8Array<ArrayBufferLike>;
        alias: Uint8Array<ArrayBufferLike>;
    }, import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "GetAliasErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotInRing">>;
    getLegacyAccounts(): import("neverthrow").ResultAsync<{
        publicKey: Uint8Array<ArrayBufferLike>;
        name: string | undefined;
    }[], import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::Rejected"> | import("@novasamatech/scale").CodecError<undefined, "RequestCredentialsErr::DomainNotValid"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RequestCredentialsErr::Unknown">>;
    /**
     * Produces an anonymous ring VRF proof with `keyHandle` under `context` in
     * `ring` (RFC-0004, amended by RFC-0024).
     *
     * A proof is a bearer token for its context's alias, so a *foreign*
     * `keyHandle` is admitted only when the owning product allowlisted this one
     * in its manifest — there is no user-prompt fallback, and the host returns
     * `NotAllowlisted` otherwise.
     */
    createRingVRFProof(keyHandle: RingVrfKeyHandle, context: ProofContext, ring: CodecType<typeof RingLocation>, message: Uint8Array): import("neverthrow").ResultAsync<{
        proof: Uint8Array<ArrayBufferLike>;
        contextualAlias: {
            context: Uint8Array<ArrayBufferLike>;
            alias: Uint8Array<ArrayBufferLike>;
        };
        ringIndex: number;
        ringRevision: number;
    }, import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "CreateProofErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotInRing"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotAllowlisted">>;
    /**
     * Signs `message` with the ring VRF member key itself, producing an ordinary
     * signature rather than an anonymous ring proof (RFC-0024).
     *
     * Takes no context and no ring: it derives no alias and proves no
     * membership. A verifier needs the member public key, so the signature is
     * **linkable** to every other use of that key — including every ring the key
     * is a member of.
     *
     * Like `createRingVRFProof`, a foreign `keyHandle` requires the owner's
     * manifest allowlist and has no prompt fallback.
     */
    ringVrfSign(keyHandle: RingVrfKeyHandle, message: Uint8Array): import("neverthrow").ResultAsync<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "RingVrfSignErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotAllowlisted">>;
    /**
     * Produces an sr25519 (schnorrkel) VRF signature from a product account (RFC-0023).
     *
     * The host replays `transcriptLabel` and `items` into a Merlin transcript verbatim —
     * `Transcript::new(transcriptLabel)` then one `append_message(label, value)` per item,
     * in order — and signs it. Callers that need a `signer` item must pass their own public
     * key (from `getProductAccount`); the host never injects it.
     */
    signVrf(dotNsIdentifier: string, derivationIndex: AccountSelector, transcriptLabel: Uint8Array, items: VrfTranscriptItem[]): import("neverthrow").ResultAsync<{
        preOutput: Uint8Array<ArrayBufferLike>;
        proof: Uint8Array<ArrayBufferLike>;
    }, import("@novasamatech/scale").CodecError<undefined, "SignVrfErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "SignVrfErr::Rejected"> | import("@novasamatech/scale").CodecError<{
        reason: string;
    }, "SignVrfErr::Unknown">>;
    /**
     * Builds a `TxCreator` (polkadot-api v3) that delegates to the host via
     * `host_create_transaction`. The host keeps ownership of extension inference
     * and signing; the creator maps the v3 `TxPayloadV1` onto the host codec.
     *
     * `publicKey` is exposed synchronously on the returned object and is taken
     * from `account`, so no up-front `host_account_get` is needed.
     */
    getProductAccountSigner(account: ProductAccount, signerType?: "signPayload" | "createTransaction"): SignerTxCreator;
    subscribeAccountConnectionStatus(callback: (status: AccountConnectionStatus) => void): Subscription<void>;
    getLegacyAccountSigner(account: LegacyAccount): SignerTxCreator;
};