interface GenerateInput {
  credential: string;         // Base64-encoded WebAuthn credential
  identifier?: string;        // Verified identifier (email, phone)
  channel?: string;           // Verification channel ("email", "sms")
  verification_proof?: string; // Signed attestation from the registrar
}

interface GenerateOutput {
  did: string;           // Decentralized identifier (did:new:0x...)
  database: number[];    // Encrypted SQLite database bytes
  enclave_id: string;    // MPC enclave identifier
  public_key: string;    // Compressed or uncompressed public key hex
  pubkey_x?: string;     // P-256 X coordinate (hex, 32 bytes)
  pubkey_y?: string;     // P-256 Y coordinate (hex, 32 bytes)
  accounts: AccountInfo[];
}

interface GenerateOutputWithShares extends GenerateOutput {
  encrypted_shares?: EncryptedShares;
  public_key_hex?: string;
}

interface GenerateResult {
  success: boolean;
  did: string;
  address: string;
  shares: EncryptedShares & { enclave_id: string };
  parsed_credential: Record<string, unknown>;
}

interface AccountInfo {
  address: string;   // Blockchain address
  chain_id: string;  // Chain ID string (e.g., "84532")
}

interface Account {
  address: string;
  chain_id: string;
  coin_type: number;
  account_index: number;
  address_index: number;
  label: string;
  is_default: boolean;
}

interface VerificationMethod {
  id: string;          // Method ID (did:new:abc#key-1)
  type: string;        // Key type (e.g., "EcdsaSecp256r1VerificationKey2019")
  controller: string;  // Controller DID
  public_key: string;  // Base64-encoded public key
  purpose: string;     // Key purpose (authentication, assertion, etc.)
}

interface Credential {
  credential_id: string;  // WebAuthn credential ID (base64url)
  device_name: string;
  device_type: string;    // "platform" or "cross-platform"
  authenticator: string;  // Device name (Touch ID, Face ID, YubiKey, etc.)
  transports: string[];   // Available transports (internal, usb, nfc, ble)
  created_at: string;     // ISO 8601 timestamp
  last_used: string;      // ISO 8601 timestamp
}

interface CreateRegistrationInput {
  sender: string;  // Smart account address (EVM, checksum not required)
  alias: string;   // On-chain alias (handle)
  cid?: string;    // Optional IPFS metadata CID
  did?: string;    // Optional DID override
}

interface RegistrationResult {
  user_op: UserOp | null;  // Unsigned UserOperation (null if no on-chain tx needed)
  did_hash: string;         // Keccak256 hash of the DID
  alias_hash: string;       // Keccak256 hash of the alias
  metadata_cid: string;     // IPFS CID of DID metadata
  call_data: string;        // Encoded calldata for the smart account
  entry_point: string;      // ERC-4337 EntryPoint contract address
  registry_addr: string;    // DID Registry contract address
}

interface LoadInput {
  database: number[];  // Encrypted SQLite database bytes
}

interface LoadOutput {
  success: boolean;
  did?: string;    // DID of the loaded vault
  error?: string;
}

interface LockOutput {
  success: boolean;
  database?: number[];  // Encrypted database bytes (store client-side for restore)
  error?: string;
}

interface UnlockInput {
  database: number[];  // Encrypted database bytes from a previous lock
}

interface UnlockOutput {
  success: boolean;
  did?: string;   // DID of the unlocked vault
  error?: string;
}

interface StatusOutput {
  locked: boolean;
  initialized: boolean;
  did?: string;             // Current vault DID (absent if not initialized)
  last_activity?: string;   // ISO 8601 timestamp of last operation
}

interface QueryInput {
  did: string;  // DID to query; empty string resolves to current vault DID
}

interface QueryOutput {
  did: string;
  controller: string;
  verification_methods: VerificationMethod[];
  accounts: Account[];
  credentials: Credential[];
}

interface ExecInput {
  filter: string;   // Resource-action filter (e.g., "resource:accounts action:list")
  token?: string;   // Optional UCAN delegation token
}

interface ExecOutput<T = unknown> {
  success: boolean;
  result?: T;
  error?: string;
}

interface VaultExportOutput {
  success: boolean;
  data?: number[];       // Encrypted vault bytes (MTRV format)
  did?: string;
  exported_at?: string;  // ISO 8601 timestamp
  error?: string;
}

interface VaultImportOutput {
  success: boolean;
  did?: string;
  accounts?: number;     // Count of imported accounts
  credentials?: number;  // Count of imported credentials
  error?: string;
}

interface VaultExportOptions {
  password: string;  // Password used to encrypt the export (AES-256-GCM via Argon2id KDF)
}

interface VaultImportOptions {
  data: Uint8Array | number[];  // Encrypted vault bytes
  password: string;             // Password used during export
}

interface UserOp {
  sender: string;
  nonce: string;
  factory: string | null;
  factoryData: string | null;
  callData: string;
  callGasLimit: string;
  verificationGasLimit: string;
  preVerificationGas: string;
  maxFeePerGas: string;
  maxPriorityFeePerGas: string;
  paymaster: string | null;
  paymasterVerificationGasLimit: string | null;
  paymasterPostOpGasLimit: string | null;
  paymasterData: string | null;
  signature: string;
}

interface SignUserOpResult {
  signature: string;       // Hex-encoded ERC-4337 signature
  user_op_hash: string;    // UserOperation hash
  enclave_id: string;      // MPC enclave identifier used for signing
  public_key: string;      // Public key hex used for signing
}

interface GetSmartAccountAddressInput {
  pubKeyX: string;                  // P-256 X coordinate (hex)
  pubKeyY: string;                  // P-256 Y coordinate (hex)
  salt?: string | number | bigint;  // Counterfactual salt (default: 0)
  vaultUrl?: string;                // Override vault base URL
}

interface GetAccountStateInput {
  account: string;    // Smart account address
  vaultUrl?: string;  // Override vault base URL
}

interface AccountState {
  nonce: string;     // Account nonce (decimal string)
  did: string;       // Associated DID hash (0x-prefixed hex)
  isActive: boolean;
  pubKeyX: string;   // P-256 X coordinate (0x-prefixed hex)
  pubKeyY: string;   // P-256 Y coordinate (0x-prefixed hex)
}

type Resource =
  | 'accounts'
  | 'credentials'
  | 'sessions'
  | 'grants'
  | 'enclaves'
  | 'delegations'
  | 'ucans'
  | 'verification_methods'
  | 'services'
  | 'service_configs'
  | 'tokens'
  | 'invocations'
  | 'sync'
  | 'oidc';

interface DelegationOptions {
  to: string;                          // Audience DID
  command: string;                     // UCAN command path (e.g., "/vault/read")
  expiration?: number;                 // Expiration timestamp (seconds since epoch)
  caveats?: Record<string, unknown>;   // Optional attenuation / caveats
}

interface InvocationOptions {
  command: string;                   // UCAN command path
  args?: Record<string, unknown>;    // Arguments to the invocation
  token?: string;                    // Delegation token to invoke with
}

interface SyncInitResult {
  success: boolean;
  session_id?: string;  // Opaque session identifier
  public_key?: string;  // Initiating device's ephemeral public key
  expires_at?: string;  // ISO 8601 expiration timestamp
  error?: string;
}

interface SyncRespondResult {
  success: boolean;
  session_id?: string;
  public_key?: string;         // Responding device's ephemeral public key
  encrypted_vault?: string;    // Base64-encoded encrypted vault payload
  status?: string;
  error?: string;
}

interface SyncCompleteResult {
  success: boolean;
  session_id?: string;
  did?: string;     // DID of the merged vault
  status?: string;
  error?: string;
}

interface PaymentParams {
  to: string;       // Recipient address or DID
  amount: string;   // Amount in wei (ERC-20 or ETH)
  token: string;    // ERC-20 token address or "native" for ETH
  chainId: number;
  ucan?: string;    // Optional UCAN delegation token for spending constraints
  label?: string;   // Optional label for the payment
}

interface PaymentResult {
  txHash: string;       // UserOperation hash (same as userOpHash)
  userOpHash: string;   // UserOperation hash
  chain: number;        // Chain ID
  token: string;        // Token address or "native"
  explorerUrl: string;  // Block explorer URL for the transaction
}

interface PaymentHandlerOptions {
  swUrl?: string;      // Service worker URL (default: "/pay/sw.js")
  scope?: string;      // Service worker scope (default: "/pay/")
  methodUrl?: string;  // Payment method identifier URL (default: "https://did.run/pay")
}

interface PaymentHandlerRegistration {
  success: boolean;
  scope: string;
  error?: string;  // Present when success is false
}

type BinaryPayload = number[] | string;

interface EncryptedShares {
  public_key: BinaryPayload;
  public_key_hex?: string;
  val_share: BinaryPayload;    // Validator share (encrypted)
  user_share: BinaryPayload;   // User share (encrypted)
  nonce: BinaryPayload;        // Encryption nonce
  curve: string;               // Elliptic curve ("P-256", "secp256k1")
  pubkey_x?: string;           // P-256 X coordinate (hex)
  pubkey_y?: string;           // P-256 Y coordinate (hex)
}

interface SignResult {
  signature: number[];  // Raw signature bytes
}

interface DeriveAddressResult {
  address: string;  // Derived blockchain address
  chain: string;    // Chain name or ID
}

interface MintUcanResult {
  signed_dag_cbor: number[];  // DAG-CBOR encoded signed UCAN token
}

interface ParseWebAuthnResult {
  parsed: Record<string, unknown>;  // Parsed WebAuthn credential fields
}

interface BootStatus {
  enclave: boolean;  // Enclave WASM loaded and initialized
  helia: boolean;    // Helia IPFS node ready
  libp2p: boolean;   // libp2p networking ready
  ready: boolean;    // All subsystems ready
}

interface BootEvent {
  type: 'boot-progress';
  subsystem: string;                          // "enclave", "helia", or "libp2p"
  status: 'booting' | 'ready' | 'failed';
  error?: string;
}

interface CreatePasskeyResult {
  credential: string;    // Base64-encoded serialized WebAuthn credential
  credentialId: string;  // WebAuthn credential ID (passkey identifier)
}

interface CreatePasskeyOptions {
  rpName?: string;              // Relying party display name (default: "HyperAuth")
  rpId?: string;                // Relying party ID (default: "did.run")
  timeout?: number;             // Ceremony timeout ms (default: 60000)
  excludeCredentials?: {
    id: BufferSource;
    type: 'public-key';
    transports?: AuthenticatorTransport[];
  }[];
}

interface DeviceCapabilities {
  webAuthnSupported: boolean;
  platformAuthAvailable: boolean;
  conditionalMediationAvailable: boolean;
}

interface VaultManifest {
  rootCid: string | null;  // CID of latest Helia DAG-CBOR snapshot; null before first snapshot
  did: string;
  updatedAt: number;       // Unix timestamp (ms) of last persist
  wasmVersion: string;     // Enclave WASM version at time of persist
  schemaVersion: number;   // Always 1 for v0.1
}

interface VaultStoreConfig {
  dbName?: string;  // wa-sqlite database name (default: "hyperauth-vault")
}

interface VaultSnapshotConfig {
  gatewayUrl?: string;  // IPFS gateway URL for read fallback (e.g., "https://trustless-gateway.link")
}

type PinStatus = 'queued' | 'pinning' | 'pinned' | 'failed';

interface PinRequest {
  cid: string;
  name?: string;       // Human-readable label (max 255 chars)
  origins?: string[];  // Multiaddrs of known data providers
  meta?: Record<string, string>;
}

interface PinInfo {
  requestId: string;
  status: PinStatus;
  created: string;     // ISO 8601
  pin: PinRequest;
  delegates: string[]; // Multiaddrs of peers serving the content
}

interface IndexerAlias {
  found: boolean;
  alias_hash?: string;
  did_hash?: string;
  active?: boolean;
  controller?: string;
}

interface IndexerDid {
  found: boolean;
  did_hash?: string;
  controller?: string;
  metadata_cid?: string;
  active?: boolean;
  block_number?: string;
  tx_hash?: string;
}

interface IndexerAccount {
  found: boolean;
  account_address?: string;
  owner_address?: string;
  block_number?: string;
  tx_hash?: string;
}

interface IndexerStats {
  total_dids: number;
  active_dids: number;
  total_aliases: number;
  total_accounts: number;
  last_block_number: number;
}

interface IndexerHealth {
  ok: boolean;
  chain: number;
}

type Keccak256Fn = (value: Uint8Array | `0x${string}`) => `0x${string}`;

class HyperAuthError extends Error {
  readonly name: string; // "HyperAuthError"
}

class WasmLoadError extends HyperAuthError {
  readonly name = 'WasmLoadError';
}

class PluginCallError extends HyperAuthError {
  readonly name = 'PluginCallError';
  readonly functionName: string;
}

class ClientStateError extends HyperAuthError {
  readonly name = 'ClientStateError';
}

class WebAuthnError extends HyperAuthError {
  readonly name = 'WebAuthnError';
}

class NetworkError extends HyperAuthError {
  readonly name = 'NetworkError';
}

class StorageError extends HyperAuthError {
  readonly name = 'StorageError';
}