import { type proto } from '@reclaimprotocol/attestor-core';
import './patch-domhandler.ts';
import type { ReclaimProvider } from '../provider/schema.ts';
export interface AttestorLogEntry {
    level: 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal';
    msg: string;
    ctx?: Record<string, unknown>;
}
/** The attestor's signed claim data + signature, for building the exact legacy
 *  Proof a Consumer verifies against the attestor's key. Populated when
 *  `includeAttestorClaim` is set (the app's verification runner needs it; the
 *  MCP `run_proof` tool ignores it). */
export interface AttestorClaim {
    /** ProviderClaimData: provider, parameters, context (JSON string), owner,
     *  timestampS, epoch, identifier. */
    claim: Record<string, unknown>;
    /** Hex (0x) attestor ETH address that signed the claim (the nested `kid`). */
    attestorAddress: string;
    /** Hex (0x) attestor claim signature (EIP-191 over the claim sign-data). */
    claimSignature: string;
}
/** Options for {@link runAttestorProof}. */
export interface RunAttestorProofOptions {
    attestorUrl?: string;
    /** Optional session-bound authorization generated by the trusted backend. */
    authRequest?: proto.AuthenticationRequest;
    /** When resolving the key from env/.env/file, the address the caller expects
     *  to sign with (sanity check). Ignored when `ownerPrivateKey` is given. */
    ownerAddress?: string;
    /** Sign with this key directly (for example, the app or VC's ephemeral
     *  per-session key) instead of resolving from env/.env/file. */
    ownerPrivateKey?: string;
    /** ZK engine for `createClaimOnAttestor`. Defaults to `'stwo'` — a pure-WASM
     *  prover that runs everywhere (no native shared library, so it works on
     *  Windows where `'gnark'` fails to load its `.dll`). Server-side paths that
     *  want gnark's speed pin it explicitly (for example, the verify runner). */
    zkEngine?: 'gnark' | 'snarkjs' | 'stwo';
    /** Extract the structured {@link AttestorClaim} (claim + attestor signature)
     *  onto the result for legacy Proof construction. */
    includeAttestorClaim?: boolean;
}
export interface ProofResult {
    proof: unknown;
    extractedValue: string;
    extractedParameters: Record<string, string>;
    identifier?: string;
    owner?: string;
    verified: boolean;
    error?: string;
    /** Structured claim + signature for legacy Proof verification. Set only when
     *  `includeAttestorClaim` was requested and the claim carries signatures. */
    attestorClaim?: AttestorClaim;
    /** Set to `'missing-owner-key'` when no credential was available to
     *  sign with — distinguishes this recoverable case from other proof
     *  errors so the skill can point the dev at `issue_credentials` /
     *  `list_cached_credentials` rather than guessing. */
    errorKind?: 'missing-owner-key';
    /** Pino-style log entries captured from the attestor SDK during the
     *  proof attempt. Full stream on the result; the MCP layer trims it
     *  for the LLM-visible response and dumps the whole thing to disk
     *  via `runLogPath`. */
    attestorLogs?: AttestorLogEntry[];
    /** The exact `params` object passed to `createClaimOnAttestor` for
     *  this attempt. Only included on error so the LLM/dev can confirm
     *  what the attestor actually saw vs what they thought they sent
     *  (catches mutation bugs / template-substitution surprises). Never
     *  carries the captured secrets — those live in `secretParams` which
     *  is not echoed here. */
    sentParams?: unknown;
}
/** Trim a captured log stream to the last N entries — for shrinking the
 *  LLM-visible response while the full stream stays in the on-disk dump. */
export declare function tailLogs(entries: AttestorLogEntry[], n?: number): AttestorLogEntry[];
/** Filter to just warn/error/fatal — for the LLM-visible response on
 *  successful proofs, where chatty trace/info would just waste context. */
export declare function warnsAndErrors(entries: AttestorLogEntry[]): AttestorLogEntry[];
export declare function runAttestorProof(provider: ReclaimProvider, secrets: Record<string, string>, opts?: RunAttestorProofOptions): Promise<ProofResult>;