import { type CreateKernelAccountReturnType } from '@zerodev/sdk';
import type { KernelValidator } from '@zerodev/sdk/types';
import { type PublicClient } from 'viem';
import { ValidatorType } from '../account/evm/config';
import { AddressVersion } from '../config';
import type { Secp256k1PrivateKeyBytes, Secp256k1Signer } from '../cryptography';
import type { AddressIndex, Brand, EvmAddress, Seed } from '../types';
/**
 * Default kernel version for account creation
 */
export declare const DEFAULT_KERNEL_VERSION: import("@zerodev/sdk/types").KERNEL_V3_VERSION_TYPE;
/**
 * Default entry point version
 */
export declare const DEFAULT_ENTRY_POINT: import("@zerodev/sdk/types").EntryPointType<"0.7">;
/**
 * Authorized validator types for kernel accounts
 */
export type KernelAuth = {
    type: ValidatorType.SECP256k1;
    signer: Secp256k1Signer;
};
/**
 * Stub auth for read-only kernel accounts
 *
 * Uses stub signers that throw errors when signing methods are called,
 * allowing account creation for gas estimation without access to private keys.
 */
export type KernelStubAuth = {
    type: ValidatorType.SECP256k1;
    stubSigner: Secp256k1Signer;
};
/**
 * Authorized kernel account with validator
 *
 * Contains both the kernel account and the validator plugin that was used to create it.
 * This allows easy access to the validator for operations like changeSudoValidator.
 */
export type AuthorizedKernelAccount = {
    account: CreateKernelAccountReturnType;
    validator: KernelValidator<string>;
};
/**
 * Branded type for read-only kernel accounts
 */
export type ReadOnlyKernelAccount = Brand<CreateKernelAccountReturnType, 'ReadOnlyKernelAccount'>;
/**
 * Address information including address and private key
 */
export type GeneratedAddressDataV1 = {
    /**
     * Address index (0-based)
     */
    index: AddressIndex;
    /**
     * Address (works across all chains)
     */
    address: EvmAddress;
    secp256k1PublicKeyHash: EvmAddress;
    /**
     * Secp256k1 private key
     * P11TODO: This should be returned encrypted and base64-encoded in the future
     */
    secp256k1PrivateKey: Secp256k1PrivateKeyBytes;
    /**
     * Version of the address
     */
    version: AddressVersion;
};
/**
 * Generate an authorized kernel account client
 *
 * Creates a kernel account with the specified validator and configuration.
 *
 * @param publicClient A viem PublicClient for the chain
 * @param auth The authorized validator (currently only Secp256k1Validator supported)
 * @param kernelVersion The kernel version to use (default: KERNEL_V3_3)
 * @param entryPoint The entry point to use (default: 0.7)
 * @param address Optional account address (for existing accounts)
 * @param factoryIndex CREATE2 index baked into Kernel factory data (must match address derivation)
 * @returns Authorized kernel account containing both account and validator
 *
 * P11TODO: add unit tests for `generateAuthorizedKernelAccount`
 *
 */
export declare function generateAuthorizedKernelAccount(publicClient: PublicClient, auth: KernelAuth, kernelVersion?: typeof DEFAULT_KERNEL_VERSION, entryPoint?: typeof DEFAULT_ENTRY_POINT, address?: EvmAddress, factoryIndex?: AddressIndex): Promise<AuthorizedKernelAccount>;
/**
 * Create a stub signer for Secp256k1 public key hash
 *
 * The stub signer has the correct address but throws errors when
 * any signing methods are called, preventing accidental use in
 * operations that require actual signing.
 *
 * P11TODO: Add unit tests for createSecp256k1StubSigner to verify:
 * - Creates signer with correct address
 * - All signing methods (sign, signMessage, signTransaction, signTypedData, signAuthorization) throw appropriate errors
 * - Error messages are correct
 *
 * @param secp256k1PublicKeyHash The Secp256k1 public key hash
 * @returns A stub signer that throws on signing attempts
 */
export declare function createSecp256k1StubSigner(secp256k1PublicKeyHash: EvmAddress): Secp256k1Signer;
/**
 * Generate a read only kernel account client
 *
 * Uses a stub signer to create a kernel account client for an existing account.
 *
 * @param publicClient A viem PublicClient for the chain
 * @param stubAuth The stub auth configuration with stub signer
 * @param kernelVersion The kernel version to use (default: KERNEL_V3_3)
 * @param entryPoint The entry point to use (default: 0.7)
 * @param address The account address (required for read-only accounts)
 * @param factoryIndex CREATE2 index baked into Kernel factory data (must match address derivation)
 * @returns The kernel account client
 */
export declare function generateReadOnlyKernelAccount(publicClient: PublicClient, stubAuth: KernelStubAuth, kernelVersion: typeof DEFAULT_KERNEL_VERSION | undefined, entryPoint: typeof DEFAULT_ENTRY_POINT | undefined, address: EvmAddress, factoryIndex?: AddressIndex): Promise<ReadOnlyKernelAccount>;
/**
 * Generate a single address (V1) from a mnemonic at a specific index.
 *
 * This is the V1 implementation that handles all the derivation logic:
 * - Derives secp256k1 private key using BIP-85
 * - Converts to signer
 * - Computes the KernelV3.3 counterfactual address offline via CREATE2
 *
 * No RPC call is made. The Kernel account address is a deterministic CREATE2
 * computation: given the factory address, the ECDSA validator address, and the
 * signer's EOA address, the result is the same on every EVM chain. The
 * `initCodeHash` stored in `KernelVersionToAddressesMap` captures the proxy
 * creation bytecode hash for the current kernel version, making the full
 * derivation self-contained.
 *
 * @param mnemonic BIP-39 mnemonic phrase (24 words)
 * @param index Address index (0-based)
 * @returns Address data with index, address, private key, and version
 */
export declare function generateAddressV1(seed: Seed, index: AddressIndex): Promise<GeneratedAddressDataV1>;