declare enum HttpMethod {
    GET = "GET",
    POST = "POST",
    PUT = "PUT"
}
declare enum LogType {
    SESSION_TOKEN_GENERATED = "SESSION_TOKEN_GENERATED",
    SESSION_TOKEN_FAILED = "SESSION_TOKEN_FAILED",
    VERIFICATION_STARTED = "VERIFICATION_STARTED",
    PROOF_GENERATED = "PROOF_GENERATED",
    ERROR = "ERROR",
    SUCCESS = "SUCCESS",
    FAILED = "FAILED"
}
type ProofRequestOptions = {
    log?: boolean;
    sessionId?: string;
};
type ApplicationId = string;
type ApplicationSecret = string;
type RequestUrl = string;
type ProviderId = string;
type NoReturn = void;
type SessionId = string;

declare enum ReclaimError {
    SUCCESS = 0,
    INVALID_ARGS = -1,
    CONNECTION_FAILED = -2,
    PROTOCOL_FAILED = -3,
    TIMEOUT = -4,
    MEMORY = -5,
    SESSION_NOT_FOUND = -6,
    ALREADY_COMPLETED = -7
}
declare enum AlgorithmID {
    CHACHA20_OPRF = 3,
    AES_128_OPRF = 4,
    AES_256_OPRF = 5
}
interface Options {
    method: string;
    body?: string;
    headers?: {
        [key: string]: string;
    };
    geoLocation?: string;
    paramValues?: {
        [key: string]: string;
    };
    context?: {
        contextAddress: string;
        contextMessage: string;
    };
    /** Enable TEE mode for this request (default: false) */
    useTee?: boolean;
    /** ZK proof engine for the non-TEE path. Defaults to 'stwo'; switch to
     *  'snarkjs' if you need it for circuits with larger witness sizes.
     *  Ignored when `useTee` is true. */
    zkEngine?: 'snarkjs' | 'stwo';
}
interface secretOptions {
    headers?: {
        [key: string]: string;
    };
    responseMatches?: {
        type: 'regex' | 'contains';
        value: string;
    }[];
    /** Locate the byte span to redact via `regex`, `jsonPath`, or `xPath`.
     *  Optional `hash` swaps the plain redaction for an OPRF commitment, so
     *  `extractedParameterValues.<name>` returns the hash string instead of
     *  the plaintext value:
     *   - 'oprf'     — TEE path only (`useTee: true`); commitment is computed inside the enclave.
     *   - 'oprf-raw' — non-TEE / proxy path only; forces the stwo zkEngine. */
    responseRedactions?: {
        regex?: string;
        jsonPath?: string;
        xPath?: string;
        hash?: 'oprf' | 'oprf-raw';
    }[];
    cookieStr?: string;
    paramValues?: {
        [key: string]: string;
    };
}
interface SendLogsParams {
    sessionId: string;
    logType: LogType;
    applicationId: string;
}
interface Proof {
    identifier: string;
    claimData: ProviderClaimData;
    signatures: string[];
    witnesses: WitnessData[];
    extractedParameterValues: any;
}
interface WitnessData {
    id: string;
    url: string;
}
interface ProviderClaimData {
    provider: string;
    parameters: string;
    owner: string;
    timestampS: number;
    context: string;
    identifier: string;
    epoch: number;
}
interface SignatureConfig {
    applicationId: string;
    applicationSecret: string;
    allowedUrls: string[];
    expiresAt?: number;
}
interface SignatureData {
    applicationId: string;
    allowedUrls: string[];
    expiresAt: number;
}
/** TEE attestor signature */
interface TeeSignature {
    attestor_address: string;
    claim_signature: string;
}
/** TEE claim data from protocol execution */
interface TeeClaimData {
    identifier: string;
    owner: string;
    provider: string;
    parameters: string;
    context: string;
    timestamp_s: number;
    epoch: number;
    error?: string;
}
/** TEE protocol execution result */
interface TeeProtocolResult {
    claim: TeeClaimData;
    signatures: TeeSignature[];
}
/** TEE provider request */
interface TeeProviderRequest {
    name: string;
    secretParams?: Record<string, unknown>;
    context?: string;
    [key: string]: unknown;
}
/** Runtime config passed through to libreclaim's executeProtocol. Matches the
 *  Go-side `ConfigJSON` shape — `timeout_ms` is currently not honored by the
 *  Go config struct and will be silently ignored. */
interface TeeReclaimConfig {
    teekUrl?: string;
    teetUrl?: string;
    attestorUrl?: string;
    timeout_ms?: number;
    [key: string]: unknown;
}
/** TEE WebSocket endpoints used by the TEE path. Currently hardcoded in
 *  `getTeeUrls()` (see src/utils.ts). */
interface TeeUrls {
    teekUrl: string;
    teetUrl: string;
    teeAttestorUrl: string;
}

declare class ReclaimClient {
    applicationId: string;
    applicationSecret?: string;
    signatureData?: SignatureData;
    ownerKey?: string;
    logs?: boolean;
    private teeSDK?;
    sessionId: string;
    retries: number;
    /**
     * Creates a new ReclaimClient instance
     * @param applicationId - Your Reclaim application ID
     * @param applicationSecret - Either application secret (0x...) or signature (ey...)
     * @param logs - Enable logging (optional, default: false)
     * @param retries - Default attempts per zkFetch call (optional, default: 1)
     */
    constructor(applicationId: string, applicationSecret: string, logs?: boolean, retries?: number);
    zkFetch(url: string, options?: Options, secretOptions?: secretOptions, retries?: number, retryInterval?: number): Promise<Proof | undefined>;
    /**
     * Execute zkFetch using TEE (Trusted Execution Environment)
     */
    private zkFetchWithTee;
}

/**
 * Generates a signed token for frontend use
 *
 * @param config - Configuration object
 * @returns Signed token string
 */
declare function generateSessionSignature(config: SignatureConfig): Promise<string>;
/**
 * Verifies and decodes a session signature token
 *
 * @param signature - The signature token to verify
 * @returns Decoded signature data
 * @throws {InvalidParamError} If signature is invalid or expired
 */
declare function verifySessionSignature(signature: string): SignatureData;

export { AlgorithmID, type ApplicationId, type ApplicationSecret, HttpMethod, LogType, type NoReturn, type Options, type Proof, type ProofRequestOptions, type ProviderClaimData, type ProviderId, ReclaimClient, ReclaimError, type RequestUrl, type SendLogsParams, type SessionId, type SignatureConfig, type SignatureData, type TeeClaimData, type TeeProtocolResult, type TeeProviderRequest, type TeeReclaimConfig, type TeeSignature, type TeeUrls, type WitnessData, generateSessionSignature, type secretOptions, verifySessionSignature };