/**
 * Client-side Turnkey utilities
 * Uses @turnkey/sdk-server for all Turnkey operations (no viem/ethers dependency)
 */
import { Turnkey } from '@turnkey/sdk-server';
import type { TurnkeyWallet, TurnkeyWalletAccount } from '../types.js';
/**
 * Session expired error for handling token expiration
 */
export declare class TurnkeySessionExpiredError extends Error {
    constructor(message?: string);
}
/**
 * Wrapper to handle token expiration errors
 */
export declare function withTokenExpiration<T>(fn: () => Promise<T>, onExpired?: () => void): Promise<T>;
/**
 * @deprecated This function reads server-grade org API secrets and must not be
 * used in client-side code. It has been removed from the client module to
 * enforce the server/client boundary.
 *
 * Use `createTurnkeyClient` from `@originals/auth/server` instead.
 *
 * BREAKING CHANGE: This shim throws at call time. It will be removed in a
 * future major release.
 */
export declare function initializeTurnkeyClient(_config?: Record<string, unknown>): never;
/**
 * Result of initiating an OTP flow via {@link initOtp}.
 */
export interface InitOtpResult {
    /** Unique identifier for the OTP flow. */
    otpId: string;
    /**
     * Signed bundle containing the target encryption key. The OTP code must be
     * encrypted to this bundle when calling {@link completeOtp} (Turnkey v6
     * encrypted-bundle flow).
     */
    otpEncryptionTargetBundle: string;
}
/**
 * Options for {@link completeOtp}.
 */
export interface CompleteOtpOptions {
    /**
     * Optional compressed P-256 public key (hex) to embed in the encrypted OTP
     * bundle. When omitted, an ephemeral key pair is generated and returned.
     */
    publicKey?: string;
    /**
     * Organization ID to run the verifyOtp activity under. Must match the org
     * context that ran {@link initOtp} — Turnkey scopes the OTP flow to the
     * initiating organization. Leave unset (parent org, the client's default)
     * unless `initOtp` was explicitly routed to another organization.
     */
    organizationId?: string;
    /**
     * Override for the enclave signing key used to verify the target bundle's
     * signature. ONLY for tests or non-production Turnkey environments.
     */
    dangerouslyOverrideSignerPublicKey?: string;
}
/**
 * Result of completing an OTP flow via {@link completeOtp}.
 */
export interface CompleteOtpResult {
    /** Verification token issued by Turnkey (consumed by OTP_LOGIN). */
    verificationToken: string;
    /** Turnkey sub-organization ID. */
    subOrgId: string;
    /**
     * Compressed P-256 public key (hex) that the verification token is bound
     * to. Pass this as `publicKey` to a subsequent `otpLogin` activity.
     */
    publicKey: string;
    /**
     * Private key (hex) for the ephemeral key pair, present only when no
     * `publicKey` option was supplied. Needed to prove possession of the bound
     * key in subsequent requests. Sensitive: never log or persist insecurely.
     */
    privateKey?: string;
}
/**
 * Send OTP code to email via Turnkey.
 *
 * Returns the OTP ID together with the `otpEncryptionTargetBundle`, which is
 * required by {@link completeOtp} to encrypt the OTP code (Turnkey v6 no
 * longer accepts plaintext OTP codes on verification).
 *
 * Turnkey's documented flow runs initOtp/verifyOtp under the parent
 * organization (the client's default org) and uses the sub-org only for the
 * subsequent `otpLogin`; leave `subOrgId` unset unless you know the flow
 * must be scoped otherwise, and mirror whatever org context you use here in
 * {@link completeOtp} via `options.organizationId`.
 */
export declare function initOtp(turnkeyClient: Turnkey, email: string, subOrgId?: string): Promise<InitOtpResult>;
/**
 * Complete OTP verification flow (Turnkey v6 encrypted-bundle flow).
 *
 * Encrypts the user-supplied OTP code (plus a client-generated P-256 public
 * key) to the `otpEncryptionTargetBundle` returned by {@link initOtp}, then
 * submits it as `encryptedOtpBundle` to Turnkey's `verifyOtp` activity.
 *
 * Returns the verification token, the sub-org ID, and the key pair the token
 * is bound to (for use with a subsequent `otpLogin`).
 *
 * The verifyOtp activity runs under the same org context as {@link initOtp}
 * (the parent org by default). `subOrgId` identifies the user's
 * sub-organization for the subsequent `otpLogin` and is echoed back in the
 * result; it is NOT used to route the verification itself — pass
 * `options.organizationId` only if `initOtp` was explicitly scoped to a
 * different organization.
 */
export declare function completeOtp(turnkeyClient: Turnkey, otpId: string, otpCode: string, subOrgId: string, otpEncryptionTargetBundle: string, options?: CompleteOtpOptions): Promise<CompleteOtpResult>;
/**
 * Fetch users in a sub-organization
 */
export declare function fetchUser(turnkeyClient: Turnkey, subOrgId: string, onExpired?: () => void): Promise<unknown>;
/**
 * Fetch user's wallets with accounts
 */
export declare function fetchWallets(turnkeyClient: Turnkey, subOrgId: string, onExpired?: () => void): Promise<TurnkeyWallet[]>;
/**
 * Get key by curve type from wallets
 */
export declare function getKeyByCurve(wallets: TurnkeyWallet[], curve: 'CURVE_SECP256K1' | 'CURVE_ED25519'): TurnkeyWalletAccount | null;
/**
 * Create a wallet with the required accounts for DID creation
 */
export declare function createWalletWithAccounts(turnkeyClient: Turnkey, subOrgId: string, onExpired?: () => void): Promise<TurnkeyWallet>;
/**
 * Ensure user has a wallet with the required accounts for DID creation
 */
export declare function ensureWalletWithAccounts(turnkeyClient: Turnkey, subOrgId: string, onExpired?: () => void): Promise<TurnkeyWallet[]>;
//# sourceMappingURL=turnkey-client.d.ts.map