/** Default origin of the OLD devtools backend. The client appends the
 *  `/api` route prefix itself, so this is the bare origin. Override with
 *  `RECLAIM_OLD_API_URL`. */
export declare const DEFAULT_OLD_API_URL = "https://devapi.reclaimprotocol.org";
/** Default origin of the OLD-devtools analytics-logs service — a SEPARATE host
 *  from the devtools API. Override with `RECLAIM_OLD_LOGS_URL`. */
export declare const DEFAULT_OLD_LOGS_URL = "https://logs.reclaimprotocol.org";
/**
 * Externally-supplied caller identity. We do NOT mint these — the dev
 * provides one:
 *   - `bearer`: a Firebase ID token from the devtools dashboard. Attached
 *     as `Authorization: Bearer …`; `POST /api/users/login` provisions the
 *     user row on first use.
 *   - `eth`: an `eth:<lowercase-address>` uid for an already-provisioned
 *     eth user. Attached as the `x-eth-uid` header (no signature — the
 *     backend trusts the header for a uid that already exists).
 */
export type OldIdentity = {
    kind: 'bearer';
    token: string;
} | {
    kind: 'eth';
    uid: string;
};
export interface RegisterProviderBody {
    name: string;
    description?: string;
    loginUrl: string;
    geoLocation?: string;
    /** Provider-level flag on the old backend (defaults false there; the
     *  translator sends `true` to match the builder default). */
    useProxy?: boolean;
    providerType?: 'PRIVATE' | 'PUBLIC';
    requestData: unknown[];
    /** Page-injection script (old-devtools name for the builder's
     *  `webSettings.jsUserScripts`). Top-level on register; nested under
     *  `providerConfig` on the config (add-version) body instead. */
    customInjection?: string;
    /** Accepted at register too (unlike most `providerConfig` extras, which
     *  the register controller only reads on config/add-version). */
    userAgent?: {
        ios?: string;
        android?: string;
    };
    /** Accepted at register too. */
    pageTitle?: string;
    /** Accepted at register too — verified straight from the register
     *  controller's destructure + its `providerConfig` write, both of which
     *  include it alongside `pageTitle`/`userAgent`. */
    stepsToFollow?: string;
    /** Interception mechanism (`NONE` = standard replay flow, the default;
     *  `HAWKEYE`/`MSWJS`/`XHOOK` = JS-context interception; `CDP` = browser-
     *  level). Column default is `HAWKEYE` when omitted entirely — unlike
     *  `stepsToFollow`, and so on. above, whether the register endpoint actually
     *  PERSISTS this field is UNVERIFIED (no source access to confirm); sent
     *  here on the chance it does, but the publish tool always follows up
     *  with a config (add-version) call regardless, which is confirmed to
     *  persist it. */
    injectionType?: 'NONE' | 'MSWJS' | 'XHOOK' | 'CDP' | 'HAWKEYE';
}
export interface UpdateProviderConfigBody {
    providerConfig: Record<string, unknown>;
    version: string;
    versionInfo: string;
}
/** Body for `POST /api/providers/:providerId` (`updateProviderMetadata`) —
 *  a genuine PARTIAL update on the PROVIDER document itself (name/
 *  description/providerType/tags/isActive), distinct from both `register`
 *  (creates the provider) and `config` (adds an immutable new version). Only
 *  the fields present get changed; everything else is left untouched. */
export interface UpdateProviderMetadataBody {
    name?: string;
    description?: string;
    providerType?: 'PRIVATE' | 'PUBLIC';
    tags?: string[];
    isActive?: boolean;
}
export interface MyProvidersQuery {
    pageKey?: number;
    pageSize?: number;
    searchQuery?: string;
}
/** `POST /api/applications/issue-credentials` response — a brand-new,
 *  unassociated (sandboxed) app. `appSecret` is the raw eth private key;
 *  it's returned once and never stored server-side in recoverable form. */
export interface IssuedAppCredentials {
    appId: string;
    appSecret: string;
}
/** `GET /api/applications/link/nonce` response — a one-time, 5-minute-TTL
 *  challenge the caller signs with the app's private key to prove ownership
 *  in `linkAppToAccount`. */
export interface LinkNonce {
    nonce: string;
    expiresInSeconds: number;
}
/** Log-level filter accepted by the devtools backend's session-logs route.
 *  It validates against this exact list and rejects anything else with a 400,
 *  including the comma-separated lists the log-stream service itself would
 *  accept. Each value is hierarchical at the log-stream end: `fine` means
 *  FINE+CONFIG+INFO+WARNING+SEVERE, `info` means INFO+WARNING+SEVERE, and so
 *  on. `finer`/`finest` (the PII tiers) are not reachable through this route
 *  at all. */
export type SessionLogLevel = 'fine' | 'config' | 'info' | 'warning' | 'severe' | 'unknown';
/** Filters for {@link ReclaimOldClient.getSessionLogs}. Every one is optional
 *  and forwarded verbatim; the session id itself is the route's path param, so
 *  `providerId`/`deviceId` narrow WITHIN one session rather than searching
 *  across sessions. */
export interface SessionLogsQuery {
    deviceId?: string;
    source?: string;
    /** The client-side logger NAME (log-stream's `log_type` column, the SDK's
     *  `LogEntry.type`) — not the event type. */
    logType?: string;
    logLevel?: SessionLogLevel;
    providerId?: string;
    /** ISO-8601. Omitting BOTH bounds makes the log-stream service default to
     *  the last 3 days. */
    startTime?: string;
    endTime?: string;
    /** Substring match against the log line (`LIKE %…%`). */
    logLine?: string;
    /** Exact `LogEventType` name, for example `REQUEST_MATCHED`. */
    eventType?: string;
    /** Capped at 1000 by the log-stream service. */
    limit?: number;
    offset?: number;
    includeCount?: boolean;
}
/** One raw log line, in the log-stream service's snake_case ClickHouse shape,
 *  passed through unchanged by the devtools backend. `event_type` is the SDK's
 *  `LogEventType` milestone marker (`REQUEST_MATCHED`,
 *  `CLAIM_CREATION_STARTED`, `PROOF_GENERATED`, …); it is `''` on the majority
 *  of lines, which carry no event. */
export interface SessionLogRow {
    timestamp: string;
    request_id: string;
    session_id: string;
    device_id: string;
    source: string;
    app_id: string;
    provider_id: string;
    log_type: string;
    log_level: string;
    log_line: string;
    event_type?: string;
    metadata?: string;
}
/** `GET /api/logger/:sessionId`'s `data` envelope. The backend queries every
 *  region that holds the session, concatenates the pages, sorts them
 *  newest-first and re-slices to `limit`, so `data` is one page and
 *  `totalCount` is the match count across all of them. */
export interface SessionLogsPage {
    data: SessionLogRow[];
    count: number;
    totalCount?: number;
    /** Regions whose log-stream query failed — the page is INCOMPLETE when
     *  this is present. */
    failedRegions?: string[];
}
/**
 * Minimal REST client for the OLD devtools Express backend (base `/api`).
 * Deliberately NOT a clone of `@reclaimprotocol/client`'s operationId
 * machinery — the old backend has no OpenAPI spec, so this exposes a few
 * hand-written typed methods for exactly the flows old mode needs:
 * authenticate, publish (register / update version), and list-own.
 *
 * Errors are thrown as `@hapi/boom` so `remapErrorAsResponse` renders them
 * identically to builder-mode `ProblemError`s.
 */
export declare class ReclaimOldClient {
    #private;
    readonly baseUrl: string;
    readonly logsBaseUrl: string;
    constructor(opts?: {
        baseUrl?: string;
        logsBaseUrl?: string;
        identity?: OldIdentity;
        fetch?: typeof fetch;
    });
    setIdentity(identity: OldIdentity | undefined): void;
    getIdentity(): OldIdentity | undefined;
    /** Validate + provision a bearer identity. The backend creates the user
     *  row on first login, which is what makes later authed calls work. */
    loginWithToken(): Promise<unknown>;
    registerProvider(body: RegisterProviderBody): Promise<unknown>;
    updateProviderConfig(providerId: string, body: UpdateProviderConfigBody): Promise<unknown>;
    listVersions(providerId: string): Promise<unknown>;
    /** Partial update on the PROVIDER document itself — name/description/
     *  providerType/tags/isActive, after creation. The backend 403s if you
     *  don't own the provider (and aren't admin); other providerConfig-style
     *  fields sent here are simply ignored (this endpoint only reads the
     *  ones above from the body). */
    updateProviderMetadata(providerId: string, body: UpdateProviderMetadataBody): Promise<unknown>;
    /** Analytics logs for a verification session, from the logs service (a
     *  DIFFERENT host than the devtools API — hence its own fetch, not
     *  `#request`). Attaches the caller identity when one is set; queried
     *  anonymously otherwise. */
    getSessionAnalyticsLogs(sessionId: string): Promise<unknown>;
    /**
     * Raw log LINES for a verification session — the SDK's own diagnostic
     * logging, the thing the dashboard's session "logs" tab renders, and a
     * strictly richer signal than `getSessionAnalyticsLogs`'s milestone events.
     *
     * This is the devtools backend (`GET /api/logger/:sessionId`), NOT the
     * analytics-logs host — hence `#request`, and hence the same identity and
     * ownership rules as every other authed call here: the session's app must
     * be one you created (admins excepted), or the route 404s.
     *
     * The backend fans the query out to the per-region log-stream services,
     * which read the ClickHouse `logs` table. Two defaults applied down there
     * bite hard if you don't override them:
     *   - no `startTime`/`endTime` → only the last 3 days are searched;
     *   - no `logLevel` → INFO and above only, so every FINE/CONFIG line is
     *     invisible.
     * Entries are dropped entirely after 30 days (table TTL).
     */
    getSessionLogs(sessionId: string, query?: SessionLogsQuery): Promise<SessionLogsPage>;
    /** Mint a brand-new, unassociated (sandboxed) app — no auth required. Link
     *  it to an account afterwards with `getLinkNonce` + `linkAppToAccount`, or
     *  use it as-is within the sandbox session limit. */
    issueCredentials(): Promise<IssuedAppCredentials>;
    /** One-time, 5-minute challenge for `linkAppToAccount`. Requires auth —
     *  the nonce is scoped to the authenticated user's uid. */
    getLinkNonce(): Promise<LinkNonce>;
    /** Link an unassociated (`issueCredentials`-minted) app to the
     *  authenticated account. `signature` must be an EIP-191 signature, made
     *  with the app's private key, over the exact string
     *  `` `Link ${appId} to account ${userId} | nonce: ${nonce}` `` — see
     *  `buildLinkMessage` in the backend's `application.controller.ts`. Fails
     *  with `APP_ALREADY_LINKED` (400) if the app already belongs to someone. */
    linkAppToAccount(appId: string, signature: string, nonce: string): Promise<unknown>;
    /** Public, unauthenticated app status — `isLinked`, sandbox/quota info.
     *  Works for any appId, owned or not. */
    getApplicationStatus(appId: string): Promise<unknown>;
    getMyProviders(query?: MyProvidersQuery): Promise<unknown>;
}