import * as _zorsh_zorsh from '@zorsh/zorsh';
import { b } from '@zorsh/zorsh';

/**
 * Zorsh schema for NearAuthData (the full auth token data)
 * Note: zorsh uses number[] for arrays, but our API uses Uint8Array
 */
declare const NearAuthDataSchema: _zorsh_zorsh.Schema<{
    accountId: string;
    publicKey: string;
    signature: string;
    message: string;
    nonce: number[];
    recipient: string;
    callbackUrl: string | null;
    state: string | null;
}, string>;
type NearAuthData = b.infer<typeof NearAuthDataSchema>;

/**
 * Options for the main `sign` function.
 */
interface SignOptions {
    /**
     * The signer, which can be a NEAR KeyPair or a wallet object.
     * The library will detect the type at runtime.
     */
    signer: string | WalletInterface;
    /**
     * The NEAR account ID of the intended signer.
     * Required if `signer` is a KeyPair. Ignored if `signer` is a wallet
     * (as the wallet will provide the accountId).
     */
    accountId?: string;
    /**
     * The intended recipient of the signed message or action.
     * This will be included in the structured message and the signed payload.
     */
    recipient: string;
    /**
     * Optional nonce. If not provided, a nonce will be generated.
     */
    nonce?: Uint8Array;
    /**
     * Optional state object for authentication purposes, to be verified on backend.
     * This is recommended to help mitigate CSRF attacks.
     */
    state?: string;
    /**
     * Optional callback URL string.
     * If provided, this URL will receive a call after the signing process with the accountId, publicKey, signature, and state
     * <callbackUrl>#accountId=<accountId>&publicKey=<publicKey>&signature=<signature>&state=<state>.
     */
    callbackUrl?: string;
}
/**
 * Options for validating the nonce in the `verify` function.
 */
type NonceValidationOptions = {
    /**
     * Maximum age of the nonce in milliseconds.
     * If not provided, a default value (e.g., 24 hours) will be used.
     * This option is mutually exclusive with `validateNonce`.
     */
    nonceMaxAge?: number;
    validateNonce?: never;
} | {
    /**
     * A custom function to validate the nonce.
     * Should return true if the nonce is valid, false otherwise.
     * This option is mutually exclusive with `nonceMaxAge`.
     */
    validateNonce: (nonce: Uint8Array) => boolean;
    nonceMaxAge?: never;
};
/**
 * Options for validating the recipient in the `verify` function.
 */
type RecipientValidationOptions = {
    /**
     * The `recipient` field in the verified message must exactly match this string.
     * If not provided, any recipient will be valid.
     * This option is mutually exclusive with `validateRecipient`.
     */
    expectedRecipient?: string;
    validateRecipient?: never;
} | {
    /**
     * A custom function to validate the recipient.
     * Should return true if the recipient is valid, false otherwise.
     * This option is mutually exclusive with `expectedRecipient`.
     */
    validateRecipient: (recipient: string) => boolean;
    expectedRecipient?: never;
};
/**
 * Options for validating the state in the `verify` function.
 */
type StateValidationOptions = {
    /**
     * The `state` field in the verified message must exactly match this string.
     * This option is mutually exclusive with `validateState`.
     */
    expectedState?: string;
    validateState?: never;
} | {
    /**
     * A custom function to validate the state.
     * Should return true if the state is valid, false otherwise.
     * This option is mutually exclusive with `expectedState`.
     */
    validateState: (state?: string) => boolean;
    expectedState?: never;
};
/**
 * Options for validating the message in the `verify` function.
 */
type MessageValidationOptions = {
    /**
     * The `message` field in the verified token must exactly match this string.
     * This option is mutually exclusive with `validateMessage`.
     */
    expectedMessage?: string;
    validateMessage?: never;
} | {
    /**
     * A custom function to validate the message.
     * Should return true if the message is valid, false otherwise.
     * This option is mutually exclusive with `expectedMessage`.
     */
    validateMessage: (message: string) => boolean;
    expectedMessage?: never;
};
/**
 * Options for the main `verify` function.
 */
type VerifyOptions = {
    /**
     * Whether the public key used for signing must be a Full Access Key.
     * Defaults to true. If false, Function Call Access Keys are permitted
     * provided they have permission for the `recipient`.
     *
     * Full access is highly recommended, otherwise ensure message, nonce, and state validation are enforced.
     */
    requireFullAccessKey?: boolean;
} & NonceValidationOptions & RecipientValidationOptions & StateValidationOptions & MessageValidationOptions;
/**
 * The result of a successful verification.
 */
interface VerificationResult {
    /** The NEAR account ID that was successfully authenticated. */
    accountId: string;
    /** The parsed message from the verified token. */
    message: string;
    /** The public key string used for the signature. */
    publicKey: string;
    /** The callback URL from the token, if present. */
    callbackUrl?: string;
    /** The state from the token, if present. */
    state?: string;
}
/** NEP-413: Parameters for the wallet's signMessage method. */
interface SignMessageParams {
    message: string;
    recipient: string;
    nonce: Uint8Array | Buffer;
    callbackUrl?: string;
    state?: string;
}
/** NEP-413: Output from the wallet's signMessage method. */
interface SignedMessage {
    accountId: string;
    publicKey: string;
    signature: string;
    state?: string;
}
interface WalletInterface {
    /** Must conform to NEP-413 signMessage specification. */
    signMessage: (params: SignMessageParams) => Promise<SignedMessage>;
}

/**
 * Signs a message using either a KeyPair or a wallet, creating a structured
 * message and producing a NEAR authentication token.
 *
 * @param message The message to sign, can be application specific data.
 * @param options The signing options.
 * @returns A promise that resolves to the final AuthToken string.
 */
declare function sign(message: string, options: SignOptions): Promise<string>;

/**
 * Verifies a NEAR authentication token string.
 * This includes parsing the token, validating the message structure,
 * checking nonce, public key ownership, and the cryptographic signature.
 * Throws an error if verification fails at any step.
 * @param authTokenString The Base64 encoded, Borsh-serialized NearAuthData string.
 * @param options Optional verification parameters.
 * @returns A promise that resolves to VerificationResult if successful.
 */
declare function verify(authTokenString: string, options?: VerifyOptions): Promise<VerificationResult>;

/**
 * Parse a NEAR auth token into NearAuthData
 * @param authToken The authorization token string (Base64 encoded Zorsh serialized data)
 * @returns NearAuthData
 * @throws Error if the token is invalid or missing required fields
 */
declare function parseAuthToken(authToken: string): NearAuthData;

/**
 * Default max age for nonce validation (24 hours in milliseconds)
 */
/**
 * Generate a timestamp-based nonce
 * @returns A 32-byte Uint8Array containing the padded timestamp
 */
declare function generateNonce(): Uint8Array;

/**
 * Convert a string to Uint8Array
 * @param str String to convert
 * @returns Uint8Array
 */
declare function stringToUint8Array(str: string): Uint8Array;
/**
 * Convert Uint8Array to string
 * @param arr Uint8Array to convert
 * @returns String
 */
declare function uint8ArrayToString(arr: Uint8Array): string;

export { type NearAuthData, type SignOptions, type VerificationResult, type VerifyOptions, type WalletInterface, generateNonce, parseAuthToken, sign, stringToUint8Array, uint8ArrayToString, verify };