/**
 * QuantShield - Post-quantum encryption toolkit for web applications
 * Provides transparent HTTP request/response encryption with ML-KEM key exchange
 */

export interface QuantShieldConfig {
  /** Base URL for QuantShield server */
  serverUrl?: string;
  /** List of domains to intercept and encrypt */
  allowedDomains?: string[];
  /** Proxy URL for encrypted requests */
  proxyUrl?: string;
}

export interface InitializeOptions {
  /** Automatically apply fetch() and XMLHttpRequest patches (default: true) */
  autoProtect?: boolean;
  /** List of domains to intercept and encrypt (default: []) */
  allowedDomains?: string[];
}

export interface HandshakeResult {
  /** Whether handshake was successful */
  success: boolean;
  /** Session unique identifier */
  uid: string;
  /** Whether session was restored from cache */
  cached: boolean;
}

export interface QuantShieldStatus {
  /** Whether WASM module is initialized */
  initialized: boolean;
  /** Whether a valid session exists */
  hasSession: boolean;
  /** Current session UID (null if no session) */
  uid: string | null;
}

export interface EncryptionMetrics {
  /** Session unique identifier */
  uid: string;
  /** Current encryption status */
  isInitialized: boolean;
  /** WASM module loaded status */
  wasmLoaded: boolean;
}

/**
 * Main QuantShield class for post-quantum encryption
 */
export interface QuantShield {
  /**
   * Initialize WASM crypto module
   * @returns Promise that resolves when WASM is loaded
   */
  init(): Promise<boolean>;

  /**
   * Perform ML-KEM handshake with server to establish shared secret
   * @param keysUrl - Server URL for key exchange (REQUIRED)
   * @param forceNew - Force new handshake even if session exists (default: false)
   * @returns Promise with handshake result
   */
  initializeHandshake(keysUrl: string, forceNew?: boolean): Promise<HandshakeResult>;

  /**
   * Convenience method: Initialize WASM, perform handshake, and optionally apply patches
   * @param serverUrl - Server URL for key exchange (REQUIRED)
   * @param options - Configuration options
   * @param options.autoProtect - Auto-apply patches (default: true)
   * @param options.allowedDomains - Domains to intercept (default: [])
   * @returns Promise that resolves when fully initialized
   */
  initialize(serverUrl: string, options?: InitializeOptions): Promise<boolean>;

  /**
   * Apply XMLHttpRequest patching for automatic encryption
   * @param proxyUrl - Proxy server URL for encrypted requests (REQUIRED)
   * @param allowedDomains - Array of domains to intercept (default: [])
   */
  applyPatchXHR(proxyUrl: string, allowedDomains?: string[]): void;

  /**
   * Apply fetch API patching for automatic encryption
   * @param proxyUrl - Proxy server URL for encrypted requests (REQUIRED)
   * @param allowedDomains - Array of domains to intercept (default: [])
   */
  applyPatchFetch(proxyUrl: string, allowedDomains?: string[]): void;

  /**
   * Enable automatic key rotation (handshake refresh)
   * @param intervalMinutes - Refresh interval in minutes (default: 10)
   * @example
   * ```typescript
   * // Rotate keys every 10 minutes
   * QuantShield.enableAutoRefresh(10);
   * ```
   */
  enableAutoRefresh(intervalMinutes?: number): void;

  /**
   * Disable automatic key rotation
   * @example
   * ```typescript
   * QuantShield.disableAutoRefresh();
   * ```
   */
  disableAutoRefresh(): void;

  // Internal methods (not recommended for end users - used internally by SDK)
  /** @internal */
  hasValidSession(): boolean;
  /** @internal */
  clearSession(): void;
  /** @internal */
  getUID(): string | null;
  /** @internal */
  getStatus(): QuantShieldStatus;
}

/**
 * Default QuantShield instance
 */
declare const quantshield: QuantShield;

export default quantshield;