/**
 * `PasskeyKit` — the browser-side facade for creating and using smart-wallet
 * accounts with WebAuthn passkeys.
 *
 * This is a ground-up rewrite of the old monolithic `kit.ts`. The signing
 * pipeline, WebAuthn ceremonies, deploy path, and signer writes now live in
 * dependency-injected managers ({@link CredentialManager}, {@link SignerManager},
 * {@link SubmissionManager}) wired here with late-bound closures. All Protocol-27
 * probe shims, dead commented experiments, and the legacy factory-address
 * fallback are gone — the kit targets stellar-sdk >= 16 and the current wallet.
 *
 * @packageDocumentation
 */
import { xdr } from "@stellar/stellar-sdk";
import { Server } from "@stellar/stellar-sdk/rpc";
import { type AuthenticatorSelectionCriteria } from "@simplewebauthn/browser";
import type { AssembledTransaction } from "@stellar/stellar-sdk/contract";
import { Client as PasskeyClient } from "passkey-kit-sdk";
import { SignerKey, SignerStore, type ConnectWalletResult, type CreateWalletResult, type SignerLimits, type StorageAdapter } from "./types.js";
import { PasskeyEventEmitter } from "./events.js";
import { type Signer } from "./signers.js";
import type { WebAuthnClient } from "./kit/webauthn-ops.js";
import type { CreatedPasskey } from "./kit/webauthn-ops.js";
import type { SignOptions } from "./kit/tx-ops.js";
import type { WalletTx } from "./kit/wallet-ops.js";
/** Configuration for a {@link PasskeyKit} client. */
export interface PasskeyKitConfig {
    /** Stellar RPC URL. */
    rpcUrl: string;
    /** Network passphrase. */
    networkPassphrase: string;
    /** Smart-wallet WASM hash (hex) used to deploy new wallets. */
    walletWasmHash: string;
    /** WebAuthn Relying Party id (domain); defaults to the current origin. */
    rpId?: string;
    /**
     * Secret key (`S…`) for the fee-paying deployer. Defaults to the canonical
     * deterministic deployer (see {@link resolveDeployer}); overriding it changes
     * derived wallet addresses.
     */
    deploySource?: string;
    /** Transaction timeout, in seconds (default 30). */
    timeoutInSeconds?: number;
    /** Optional passkey-record storage adapter (see `passkey-kit/storage`). */
    storage?: StorageAdapter;
    /** Custom WebAuthn implementation (for testing). */
    WebAuthn?: WebAuthnClient;
}
/** Options for {@link PasskeyKit.createKey}/{@link PasskeyKit.createWallet}. */
export interface CreateOptions {
    authenticatorSelection?: AuthenticatorSelectionCriteria;
}
/** Options for {@link PasskeyKit.connectWallet}. */
export interface ConnectOptions {
    /** A specific keyId to connect (skips the discovery ceremony). */
    keyId?: string | Uint8Array;
    /** Indexer-backed keyId → contract lookup, used when derivation misses. */
    getContractId?: (keyId: string) => Promise<string | undefined>;
    /**
     * Also assert the wallet's on-chain WASM hash equals `walletWasmHash`.
     * Off by default: an upgraded wallet legitimately runs a different hash.
     */
    verifyWasmHash?: boolean;
}
export declare class PasskeyKit {
    readonly rpc: Server;
    readonly rpcUrl: string;
    readonly networkPassphrase: string;
    readonly walletWasmHash: string;
    readonly rpId?: string;
    /** Lifecycle event emitter (walletCreated, walletConnected, …). */
    readonly events: PasskeyEventEmitter;
    private readonly timeoutInSeconds;
    private readonly webAuthn;
    private readonly credentialManager;
    private readonly signerManager;
    private readonly submissionManager;
    /** The connected passkey's base64url keyId, if any. */
    keyId: string | undefined;
    /** The connected wallet client, if any. */
    wallet: PasskeyClient | undefined;
    constructor(config: PasskeyKitConfig);
    /** The connected wallet's contract id, if any. */
    get contractId(): string | undefined;
    /** The fee-paying deployer's `G…` public key. */
    get deployerPublicKey(): string;
    private signerContext;
    /** Run a passkey registration ceremony without deploying a wallet. */
    createKey(appName: string, userName: string, options?: CreateOptions): Promise<CreatedPasskey>;
    /**
     * Register a passkey and deploy a smart wallet initialized with it as the
     * first signer. Returns the signed deploy transaction (submit it via
     * `PasskeyServer`).
     */
    createWallet(appName: string, userName: string, options?: CreateOptions): Promise<CreateWalletResult>;
    /**
     * Connect an existing wallet from a passkey.
     *
     * Resolves the wallet address by (1) deterministic derivation from the keyId,
     * (2) local storage, then (3) an injected indexer lookup — and then VERIFIES
     * ownership: the keyId must resolve to a live signer on the wallet (#601 F7).
     * This closes the unverified reverse-lookup hole (#598 F3) at the SDK layer.
     *
     * @throws {WalletOwnershipError} If the keyId is not a signer on the wallet.
     */
    connectWallet(options?: ConnectOptions): Promise<ConnectWalletResult>;
    private assertWalletWasmHash;
    /** Disconnect the current wallet. */
    disconnect(): void;
    /** Sign a single auth entry (defaults to the connected passkey signer). */
    signAuthEntry(entry: xdr.SorobanAuthorizationEntry, signer?: Signer, options?: SignOptions): Promise<xdr.SorobanAuthorizationEntry>;
    /** Sign an assembled transaction's wallet auth entries. */
    sign<T>(txn: AssembledTransaction<T>, signer?: Signer, options?: SignOptions): Promise<AssembledTransaction<T>>;
    addSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
    /**
     * Update a passkey signer's limits/storage/expiration. The public key is
     * re-read from the ledger — never caller- or indexer-supplied.
     */
    updateSecp256r1(keyId: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
    addEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
    updateEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
    addPolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
    updatePolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
    remove(signerKey: SignerKey): Promise<WalletTx>;
    /** Build an `upgrade(new_wasm_hash)` transaction for the connected wallet. */
    upgrade(newWasmHash: Buffer | Uint8Array): Promise<WalletTx>;
    /** Read a signer entry from the ledger (temporary before persistent). */
    getSigner(signerKey: SignerKey): Promise<import("passkey-kit-sdk").SignerVal | null>;
    /** Require a connected wallet, or throw. */
    requireWallet(): PasskeyClient;
}
//# sourceMappingURL=kit.d.ts.map