import { BaseRecord, TagsBase } from "../../../storage/BaseRecord.mjs";
import { MdocVerificationSessionState } from "../MdocVerificationSessionState.mjs";
import { MdocDeviceRequestDefinition } from "../MdocOptions.mjs";
//#region src/modules/mdoc/repository/MdocVerificationSessionRecord.d.ts
/**
 * Session transcript of an ISO/IEC TS 18013-7:2025 Annex C (`org-iso-mdoc`) DC API session.
 *
 *   DCAPIHandover = [ "dcapi", SHA-256(CBOR([encryptionInfoBase64Url, origin])) ]
 */
export type MdocIsoDcApiVerificationSessionTranscript = {
  type: 'isoMdocDcApi';
  /**
   * Base64url encoded `EncryptionInfo` as sent to the wallet. The exact string matters: the
   * handover hashes this text, not the CBOR it encodes.
   */
  encryptionInfoBase64Url: string;
  /**
   * Base64url encoded nonce contained in the `EncryptionInfo`. Contained in
   * `encryptionInfoBase64Url` as well, and kept here only so a session can be found by the nonce
   * of the request it was created for.
   */
  nonce: string;
  /**
   * The origin the response was verified against, hashed into the handover together with the
   * `encryptionInfoBase64Url`. Only known once a response has been verified: the origin is carried
   * neither in the request nor in the response, so it has to be supplied by the verifier.
   */
  origin?: string;
};
/**
 * The protocol-specific state of a verification session: what it takes to reconstruct the session
 * transcript the device response is bound to.
 *
 * This is the only part of a verification session that differs per mdoc protocol, so a new protocol
 * is added by extending this union rather than by widening the record.
 */
export type MdocVerificationSessionTranscript = MdocIsoDcApiVerificationSessionTranscript;
export type DefaultMdocVerificationSessionRecordTags = {
  state: MdocVerificationSessionState;
  /**
   * The mdoc protocol the session uses, from {@link MdocVerificationSessionRecord.sessionTranscript}.
   */
  sessionTranscriptType: MdocVerificationSessionTranscript['type'];
  /**
   * Base64url encoded nonce of the request, for the protocols that have one. The Annex C response
   * carries no session identifier, so this is an index on the request side only — it cannot be used
   * to correlate a received response to its session.
   */
  nonce?: string;
};
export interface MdocVerificationSessionRecordProps {
  id?: string;
  createdAt?: Date;
  tags?: TagsBase;
  state: MdocVerificationSessionState;
  errorMessage?: string;
  deviceRequestBase64Url: string;
  deviceRequestDefinition: MdocDeviceRequestDefinition;
  sessionTranscript: MdocVerificationSessionTranscript;
  sessionKeyId: string;
  expiresAt: Date;
}
/**
 * A verification session for an mdoc presentation, currently the ISO/IEC TS 18013-7:2025 Annex C
 * (`org-iso-mdoc`) DC API.
 *
 * The device response is never persisted. It contains the disclosed claims, and the caller already
 * has it — for the DC API the exchange is synchronous, so the response is returned to the caller
 * rather than delivered out of band.
 */
export declare class MdocVerificationSessionRecord extends BaseRecord<DefaultMdocVerificationSessionRecordTags> {
  static readonly type = "MdocVerificationSessionRecord";
  readonly type = "MdocVerificationSessionRecord";
  state: MdocVerificationSessionState;
  /**
   * Error message of the error that occurred, set when state is {@link MdocVerificationSessionState.Error}.
   */
  errorMessage?: string;
  /**
   * Base64url encoded `DeviceRequest` as sent to the wallet.
   *
   * Only bound to the device response when the request was created with reader authentication.
   * Without reader auth the `DeviceRequest` is not covered by the session transcript, so it is a
   * record of what this agent asked for, not cryptographic evidence of it.
   */
  deviceRequestBase64Url: string;
  /**
   * The device request as this agent defined it: the requested elements of every doc request, with
   * the options that only apply when matching the device response against it, such as whether an
   * element is optional or may be device signed.
   *
   * The doc requests are in the same order as in `deviceRequestBase64Url`.
   */
  deviceRequestDefinition: MdocDeviceRequestDefinition;
  /**
   * The protocol-specific state needed to reconstruct the session transcript, and the protocol the
   * session uses.
   */
  sessionTranscript: MdocVerificationSessionTranscript;
  /**
   * Key id of the ephemeral key this agent created for the session. For the DC API this is the
   * recipient key the device response is encrypted to.
   *
   * The key outlives the session: it is deleted when the session record is deleted, so a session
   * can be inspected and its response re-processed for as long as the record is kept.
   */
  sessionKeyId: string;
  expiresAt: Date;
  constructor(props: MdocVerificationSessionRecordProps);
  /**
   * The session transcript, asserted to be of a specific protocol.
   */
  getSessionTranscript<Type extends MdocVerificationSessionTranscript['type']>(type: Type): Extract<MdocVerificationSessionTranscript, {
    type: Type;
  }>;
  assertState(expectedStates: MdocVerificationSessionState | MdocVerificationSessionState[]): void;
  get isExpired(): boolean;
  getTags(): {
    state: MdocVerificationSessionState;
    sessionTranscriptType: "isoMdocDcApi";
    nonce: string;
  };
  clone(): this;
}
//#endregion
//# sourceMappingURL=MdocVerificationSessionRecord.d.mts.map