// Thin TypeScript declarations for the relicario-wasm bindings.
// These are hand-written to mirror the #[wasm_bindgen] signatures in
// crates/relicario-wasm/src/lib.rs; keep them in sync manually.
//
// Declared under the bare specifier 'relicario-wasm' so `typeof
// import('relicario-wasm')` resolves in setup.ts. Webpack doesn't
// actually resolve the module — setup.ts loads the auto-generated
// wasm/relicario_wasm.js via a webpackIgnore dynamic import at runtime.

declare module 'relicario-wasm' {
  export class SessionHandle {
    readonly value: number;
    free(): void;
  }

  export class EncryptedAttachment {
    readonly aid: string;
    readonly bytes: Uint8Array;
    free(): void;
  }

  export class TotpCode {
    readonly code: string;
    readonly expires_at: bigint;
    free(): void;
  }

  export function unlock(
    passphrase: string,
    image_bytes: Uint8Array,
    salt: Uint8Array,
    params_json: string,
  ): SessionHandle;

  export function lock(handle: SessionHandle): boolean;

  export function manifest_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
  export function manifest_encrypt(handle: SessionHandle, manifest_json: string): Uint8Array;
  export function item_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
  export function item_encrypt(handle: SessionHandle, item_json: string): Uint8Array;
  export function settings_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
  export function settings_encrypt(handle: SessionHandle, settings_json: string): Uint8Array;
  export function default_vault_settings_json(): string;

  export function attachment_encrypt(
    handle: SessionHandle,
    plaintext: Uint8Array,
    max_bytes: bigint,
  ): EncryptedAttachment;
  export function attachment_decrypt(handle: SessionHandle, encrypted: Uint8Array): Uint8Array;

  export function new_item_id(): string;
  export function new_field_id(): string;

  export function generate_password(request_json: string): string;
  export function generate_passphrase(request_json: string): string;
  export function rate_passphrase(p: string): { score: number; guesses_log10: number };

  export function extract_image_secret(image_bytes: Uint8Array): Uint8Array;
  export function embed_image_secret(carrier: Uint8Array, secret: Uint8Array): Uint8Array;

  // Pure parsers (no session needed)
  export function parse_month_year(s: string): { month: number; year: number };
  export function base32_decode_lenient(s: string): Uint8Array;
  export function guess_mime(filename: string): string;

  export function totp_compute(config_json: string, now_unix_seconds: bigint): TotpCode;

  export function register_device(name: string): {
    signing_public_key: string;
    deploy_public_key: string;
  };

  export function sign_for_git(data: Uint8Array): {
    signature: string;
  };

  export function get_device_info(): {
    name: string;
    signing_public_key: string;
    deploy_public_key: string;
  } | null;

  export function clear_device(): void;
  export function get_field_history(item_json: string): unknown;

  export function wasm_generate_recovery_qr(handle: SessionHandle, passphrase: string): string;
  export function wasm_unwrap_recovery_qr(payload_b64: string, passphrase: string): Uint8Array;

  // Pluggable second factor: key-file bindings (Task 3)
  export function unlock_with_secret(passphrase: string, secret: Uint8Array, salt: Uint8Array, params_json: string): SessionHandle;
  export function keyfile_encode(secret: Uint8Array): Uint8Array;
  export function keyfile_decode(bytes: Uint8Array): Uint8Array;

  export default function init(module_or_path?: unknown): Promise<void>;
  export function initSync(args: { module: WebAssembly.Module }): void;
}
