export { f as AnalyticsProperties, g as AuthChangeEvent, h as AuthState, i as AuthSuccess, A as AuthUser, j as Call, k as CallChangeCallback, l as CallParticipant, m as CallState, C as Chat, n as ChatBackend, o as ChatDraft, p as ChatKind, b as ChatMember, c as ChatMessage, q as ChatMessageKind, r as ChatRole, s as ChatState, t as CommsPrefs, F as FlagsView, M as MagicLinkResult, u as MentionRange, v as MessageDirection, N as NotifyScope, O as OAuthExchangeResult, w as OAuthOptions, x as OAuthProvider, y as OAuthPurpose, z as OAuthTransaction, B as PalbeAnalytics, D as PalbeAuth, E as PalbeCalls, P as PalbeConfig, G as PalbeFlags, H as PalbeMessaging, I as PalbeOAuthConfig, J as PalbePermissions, K as PalbeRealtime, L as PresenceState, Q as RealtimeChannel, S as RealtimeChannelError, R as RealtimeConnectionState, T as RealtimeHandler, a as RealtimePayload, U as RealtimeStatus, V as RealtimeStatusSnapshot, W as RealtimeSubscription, X as ResolvedMention, Y as ResolvedReply, Z as SentReceipt, _ as SignInMethods, $ as UnreadView, a0 as Unsubscribe } from './analytics-facade-B1s6ueXl.js';
export { B as BackendError, a as BackendErrorKind, F as FieldError, i as isBackendError } from './errors-fDoNdTrJ.js';
export { C as CallOptions, P as PB, R as RoomDescriptor, a as RoomHandle, b as RoomToken, d as RoomTransport, U as UploadOptions, e as UploadProgress, j as joinRoom, p as pb } from './pb-CEUOMPJ0.js';
export { P as PersistedSession, S as SessionStorageAdapter, l as localStorageSessionStorage, m as memorySessionStorage } from './storage-Nj6JAWej.js';
export { F as FlagValue } from './pooled-flags-ByrxSmnn.js';
import './index.d-CS4ceNwT.js';

/* tslint:disable */
/* eslint-disable */

/**
 * Host group-state storage. Mirrors the native PalbeGroupStateStorage
 * (state / epoch / write / maxEpochId). All blobs are opaque MLS bytes.
 *
 * IMPORTANT: these methods are SYNCHRONOUS — mls-rs calls them inside the
 * engine's locked critical section. Back them with an in-memory cache and
 * flush to IndexedDB + WebCrypto sealing asynchronously OUTSIDE the engine call.
 */
interface IGroupStateStorage {
  /** Latest serialized group state for groupId, or undefined/null if unknown. */
  state(groupId: Uint8Array): Uint8Array | undefined | null;
  /** A specific stored prior-epoch record, or undefined/null if unknown. */
  epoch(groupId: Uint8Array, epochId: bigint): Uint8Array | undefined | null;
  /** Persist new group state + prior-epoch inserts/updates atomically. */
  write(
    groupId: Uint8Array,
    groupState: Uint8Array,
    epochInserts: { id: bigint; data: Uint8Array }[],
    epochUpdates: { id: bigint; data: Uint8Array }[],
  ): void;
  /** Highest stored prior-epoch id for groupId, or undefined/null if none. */
  maxEpochId(groupId: Uint8Array): bigint | undefined | null;
}

/**
 * Host key-package secret storage (restart-safe join). Mirrors the native
 * PalbeKeyPackageStorage (delete / insert / get). Blobs are SECRET-BEARING
 * (HPKE init/leaf private keys) — seal at rest. Synchronous, same contract as
 * IGroupStateStorage.
 */
interface IKeyPackageStorage {
  /** Securely erase the key-package secrets referenced by id. */
  delete(id: Uint8Array): void;
  /** Store the opaque (secret-bearing) key-package data under id. */
  insert(id: Uint8Array, data: Uint8Array): void;
  /** Retrieve the stored key-package data, or undefined/null if unknown. */
  get(id: Uint8Array): Uint8Array | undefined | null;
}

/**
 * Browser binding of [`PalbeMlsClient`]. Holds the same `Arc<PalbeMlsClient>`
 * the native FFI would; every method delegates to the engine.
 */
declare class MlsClient {
  private constructor();
  free(): void;
  [Symbol.dispose](): void;
  /**
   * The MLS Capabilities wire bytes (the keydir's `capabilities`).
   */
  capabilities(): Uint8Array;
  /**
   * Create a new group at epoch 0. `groupId` `undefined`/`null` lets mls-rs
   * mint a globally-unique id (the rfc_group_id routing key).
   */
  createGroup(group_id?: Uint8Array | null): MlsGroup;
  /**
   * The MLS Credential wire bytes (the keydir's `credential`).
   */
  credential(): Uint8Array;
  /**
   * The MLS-encoded enrollment material `{ signatureKey, credential,
   * capabilities }` (byte fields as arrays-of-numbers — wrap in Uint8Array as
   * needed). Base64 these into the SP-0 keydir enroll body.
   */
  enrollmentMaterial(): any;
  /**
   * Mint a one-use KeyPackage (RAW RFC 9420 §10 bytes) — uploaded to the
   * keydir, consumed by an adder's `addMember`.
   */
  generateKeyPackage(): Uint8Array;
  /**
   * Join a group from a Welcome (opaque MLSMessage bytes).
   */
  joinGroup(welcome: Uint8Array): MlsGroup;
  /**
   * Re-hydrate a previously-persisted group by its `groupId` (restart-safe
   * reload of an already-joined group).
   */
  loadGroup(group_id: Uint8Array): MlsGroup;
  /**
   * The serialized STABLE signature keypair (secret-bearing). Persist sealed
   * and pass back as `signatureKeypair` on restart so the device keeps the
   * SAME MLS signing identity.
   */
  signatureKeypair(): Uint8Array;
  /**
   * The device's STABLE signature PUBLIC key bytes (the keydir's
   * `signature_key`).
   */
  signaturePublicKey(): Uint8Array;
}

/**
 * Browser binding of [`PalbeMlsGroup`].
 */
declare class MlsGroup {
  private constructor();
  free(): void;
  [Symbol.dispose](): void;
  /**
   * Stage a member add. Returns `{ commit, welcome?, addedLeafIndices }`
   * (byte fields as arrays-of-numbers). The group is PENDING after this.
   */
  addMember(key_package_msg: Uint8Array): any;
  /**
   * Apply the staged commit (advances the local epoch). Call ONLY after the
   * server accepted the commit.
   */
  applyPendingCommit(): void;
  /**
   * Discard the staged commit without advancing (the 409-rebase path).
   */
  clearPendingCommit(): void;
  /**
   * Stage a SINGLE atomic add+remove commit. `addKeyPackages` is an
   * `Array<Uint8Array>` of one-use key packages; `removeMemberIds` an
   * `Array<Uint8Array>` of member identity bytes. Returns the same
   * `AddResult` shape as `addMember`. PENDING after this.
   */
  commitChanges(add_key_packages: Uint8Array[], remove_member_ids: Uint8Array[]): any;
  /**
   * The current (applied) epoch as a JS BigInt (u64 exceeds safe-integer).
   */
  currentEpoch(): bigint;
  /**
   * Inspect an incoming Commit and return the membership delta it WOULD
   * effect WITHOUT applying it (the reconciliation gate's crypto-truth).
   * Returns `{ kind, addedIdentities, removedIdentities }`.
   */
  describeIncomingCommit(commit_msg: Uint8Array): any;
  /**
   * Encrypt an application message at the current epoch. Returns the opaque
   * MLSMessage bytes (PrivateMessage).
   */
  encryptApplicationMessage(plaintext: Uint8Array): Uint8Array;
  /**
   * The MLS group id (the rfc_group_id routing key / storage key).
   */
  groupId(): Uint8Array;
  /**
   * True while a staged (unapplied) commit exists.
   */
  hasPendingCommit(): boolean;
  /**
   * Process an incoming MLSMessage and apply its effect. Returns a
   * `ReceivedMessage` plain object (serde-tagged enum): e.g.
   * `{ Application: { sender, data } }`, `{ CommitApplied: { epoch,
   * removedSelf } }`, `"Proposal"`, or `"Other"`.
   */
  processIncomingMessage(message: Uint8Array): any;
  /**
   * Stage a member remove (by the member's identity bytes). Returns
   * `{ commit }`. PENDING after this.
   */
  removeMember(member_id: Uint8Array): any;
  /**
   * Persist the current group state through the JS group storage callback.
   */
  writeToStorage(): void;
}

/**
 * Mint a device MLS client (browser binding of [`engine::generate_client`]).
 *
 * - `id`: the member identity bytes (the SP-0 device id `mdv_`).
 * - `group_storage`: a JS object implementing `IGroupStateStorage`.
 * - `key_package_storage`: a JS object implementing `IKeyPackageStorage`.
 * - `signature_keypair`: `undefined`/`null` on first run (a fresh keypair is
 *   minted), or the previously-persisted serialized secret-key bytes on restart.
 */
declare function generateClient(
  id: Uint8Array,
  group_storage: IGroupStateStorage,
  key_package_storage: IKeyPackageStorage,
  signature_keypair?: Uint8Array | null,
): MlsClient;

/**
 * Install the browser console panic hook so a Rust panic shows a readable
 * stack in the devtools console instead of an opaque `unreachable`. Idempotent;
 * the TS facade calls this once at module init.
 */
declare function setPanicHook(): void;

/** The subset of the glue surface the bridge calls. */
interface MlsGlue {
    generateClient: typeof generateClient;
    setPanicHook: typeof setPanicHook;
    MlsClient: typeof MlsClient;
    MlsGroup: typeof MlsGroup;
}
/**
 * Initialize the MLS WASM engine. Idempotent — call it once before any
 * messaging crypto op (the facade does this on `pb.messaging.start()` and
 * before the first chat op). Returns the glue surface (the bridge uses it).
 */
declare function initMls(): Promise<MlsGlue>;

declare const VERSION = "11.2.2";

export { VERSION, initMls };