export type AuthScheme = 'siwe' | 'siws';
/** Exact values independently approved for this one login, never copied blindly from a challenge. */
export interface AuthIntent {
  scheme: AuthScheme;
  origin: string;
  wallet: string;
  chain: string;
  nonce: string;
  issuedAt: string;
  ttlSeconds: number;
  resources: [] | ['https://privy.io'];
}
export interface ParsedChallenge extends Omit<AuthIntent, 'ttlSeconds'> {
  siteExpiresAt: string | null;
}
export interface ChallengeRequest {
  message: string;
  expected: AuthIntent;
  /** Server provenance is asserted by the caller; this offline API cannot authenticate it. */
  nonceSource: 'server' | 'fixture';
}
export interface AuthArtifact extends ChallengeRequest {
  version: 1;
  purpose: 'wallet-login-only';
  nonceProvenanceVerified: false;
  siteExpiresAt: string | null;
  localExpiresAt: string;
  requiresWalletSignature: true;
  backendSigner: false;
  autoSignSupported: false;
  digest: string;
}
export interface VerificationResult {
  ok: true;
  signatureVerified: true;
  sessionEstablished: false;
  tradingAuthorized: false;
  nonceSource: 'server' | 'fixture';
  nonceProvenanceVerified: false;
  digest: string;
  localExpiresAt: string;
  backendSigner: false;
  autoSignSupported: false;
}
export const MAX_CHALLENGE_BYTES: 4096;
export const MAX_TTL_SECONDS: 300;
export class WalletAuthError extends Error {
  constructor(code: string);
  code: string;
}
/** Structural parsing only; use prepareChallenge or verifyChallenge for intent and live expiry. */
export function parseChallenge(message: string): ParsedChallenge;
export function prepareChallenge(input: ChallengeRequest): AuthArtifact;
export function verifyChallenge(input: {
  artifact: AuthArtifact;
  expected: AuthIntent;
  /** Digest pinned when the one-shot intent was prepared, independently of the artifact file. */
  digest: string;
  /** External wallet output; CLI accepts this only through a local file. */
  signature: string;
}): VerificationResult;