@vaultkeepr/core 0.1.1

package/dist/index.d.mts

@@ -0,0 +1,793 @@
+import { LocalAccount } from 'viem/accounts';
+export { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
+
+interface VaultEntry {
+    id: string;
+    url: string;
+    username: string;
+    password: string;
+    notes?: string;
+    folder?: string;
+    title?: string;
+    urls?: VaultEntryUri[];
+    customFields?: CustomField[];
+    totpSecret?: string;
+    totpAlgorithm?: string;
+    notesMasked?: boolean;
+    useCount?: number;
+    lastUsedAt?: number;
+    createdAt?: string;
+    modifiedAt?: number;
+    customGroup?: string;
+    tags?: string[];
+    favorite?: boolean;
+    color?: string;
+    passwordHistory?: {
+        password: string;
+        changedAt: number;
+    }[];
+    passwordMaxAgeDays?: number;
+    passwordChangedAt?: number;
+}
+interface CustomField {
+    name: string;
+    value: string;
+    type: "text" | "hidden" | "url" | "boolean";
+}
+type VaultEntryUriMatchType = "exact" | "hostname" | "baseDomain" | "never";
+interface VaultEntryUri {
+    uri: string;
+    matchType?: VaultEntryUriMatchType;
+}
+interface FolderNode {
+    id: string;
+    name: string;
+    parentId: string | null;
+    icon?: string;
+    sortOrder: number;
+    createdAt: number;
+}
+interface PasskeyEntry {
+    id: string;
+    type: "passkey";
+    rpId: string;
+    rpName: string;
+    userName: string;
+    userDisplayName: string;
+    userId: string;
+    credentialId: string;
+    privateKeyHex: string;
+    publicKeyHex: string;
+    algorithm: -7;
+    counter: number;
+    createdAt: string;
+    lastUsedAt?: string;
+    transports?: string[];
+    url: string;
+    folder: "passkeys";
+    username: string;
+    password: string;
+    notes?: string;
+}
+interface SeedPhraseEntry {
+    id: string;
+    type: "seed";
+    walletName: string;
+    wordCount: 12 | 15 | 18 | 21 | 24;
+    derivationPath?: string;
+    network?: string;
+    createdAt: string;
+    url: string;
+    folder: "seeds";
+    username: string;
+    password: string;
+    notes?: string;
+}
+type SecureDocumentType = "cni" | "passport" | "permit" | "rib" | "insurance" | "other";
+interface DocumentOcrData {
+    fullName?: string;
+    firstName?: string;
+    lastName?: string;
+    documentNumber?: string;
+    expiryDate?: string;
+    birthDate?: string;
+    nationality?: string;
+    gender?: string;
+    documentType?: string;
+    issuingAuthority?: string;
+    rawText?: string;
+    faceImageBase64?: string;
+}
+interface SecureDocument {
+    id: string;
+    type: SecureDocumentType;
+    label: string;
+    fragments: string[];
+    nonce: string;
+    nfcFaceFragments?: string[];
+    nfcFaceNonce?: string;
+    blurredThumbnail: string;
+    ocr?: DocumentOcrData;
+    originalSize: number;
+    mimeType: string;
+    addedAt: string;
+    modifiedAt?: number;
+}
+type CloudFileCategory = "photo" | "document";
+interface CloudFile {
+    id: string;
+    category: CloudFileCategory;
+    fileName: string;
+    folder?: string;
+    fragments: string[];
+    nonce: string;
+    thumbnail?: string;
+    originalSize: number;
+    mimeType: string;
+    fragmentCount: number;
+    contentHash: string;
+    description?: string;
+    tags?: string[];
+    favorite?: boolean;
+    addedAt: string;
+    modifiedAt?: number;
+}
+declare const DEFAULT_FRAGMENT_COUNT = 4;
+interface Vault {
+    version: number;
+    createdAt: string;
+    entries: VaultEntry[];
+    folders: string[];
+    folderTree?: FolderNode[];
+    documents?: SecureDocument[];
+    cloudFiles?: CloudFile[];
+    cloudFolders?: string[];
+    cloudQuotaUsed?: number;
+    folderTombstones?: Record<string, number>;
+    cloudFolderTombstones?: Record<string, number>;
+    entryTombstones?: Record<string, number>;
+    legacyContacts?: LegacyContact[];
+    prfCredentials?: PrfCredentialRecord[];
+    monitoredEmails?: string[];
+}
+interface PrfCredentialRecord {
+    credentialId: string;
+    prfSalt: string;
+    authenticatorType: string;
+    deviceName: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+    passwordHash: string;
+}
+interface LegacyContact {
+    label: string;
+    email?: string;
+    telegram?: string;
+    address?: string;
+    publicKey?: string;
+    status: "pending" | "confirmed";
+    addedAt: string;
+}
+interface EncryptedVault {
+    ciphertext: string;
+    nonce: string;
+    envelope?: string;
+    commitment?: string;
+    version: number;
+}
+interface KeyEnvelope {
+    ephemeralPublicKey: string;
+    ciphertext: string;
+    nonce: string;
+}
+interface VaultPayload {
+    ciphertext: string;
+    nonce: string;
+    envelope: KeyEnvelope;
+    version: number;
+}
+type FragmentDestination = "device" | "ipfs" | "contact" | "smartcontract" | "api";
+declare const FRAGMENTED_DEFAULT_THRESHOLD = 3;
+declare const FRAGMENTED_DEFAULT_TOTAL = 5;
+interface FragmentedConfig {
+    threshold: number;
+    total: number;
+    distribution: Record<FragmentDestination, number>;
+}
+interface FragmentedPayload {
+    version: 5;
+    ciphertext: string;
+    nonce: string;
+    commitment?: string;
+    threshold: number;
+    total: number;
+    lookupIdHash: string;
+    updatedAt?: number;
+}
+interface EncryptedFragmentPayload {
+    version: 5;
+    fragmentIndex: number;
+    ciphertext: string;
+    nonce: string;
+}
+interface FragmentedManifest {
+    version: 5;
+    lookupIdHash: string;
+    vaultCid: string;
+    threshold: number;
+    total: number;
+    partCids: Record<number, string>;
+    updatedAt: number;
+}
+
+declare const ENTRY_GROUP_IDS: readonly ["identifiants", "cartes", "notes", "identites", "seeds"];
+type EntryGroupId = (typeof ENTRY_GROUP_IDS)[number];
+declare const ENTRY_GROUP_LABELS: Record<EntryGroupId, string>;
+declare const DEFAULT_ENTRY_GROUP: EntryGroupId;
+declare const BUILTIN_FOLDER_IDS: Record<EntryGroupId | "passkeys", string>;
+declare const BUILTIN_FOLDER_NODES: FolderNode[];
+declare function getEntryGroupLabel(folder: string | undefined): string;
+declare function resolveFolderName(folderId: string | undefined, folderTree: FolderNode[] | undefined): string;
+
+declare function generateMasterKey(): Uint8Array;
+declare function encryptVault(plaintext: string | Uint8Array, masterKey: Uint8Array, opts?: {
+    wipeKeyAfterUse?: boolean;
+}): EncryptedVault;
+declare function decryptVault(encrypted: EncryptedVault, masterKey: Uint8Array, opts?: {
+    wipeKeyAfterUse?: boolean;
+}): string | Uint8Array;
+declare function compressVault(vaultJson: string): Promise<Uint8Array>;
+declare function decompressVault(data: Uint8Array): Promise<string>;
+
+declare function secureWipe(buf: Uint8Array | null): void;
+declare function secureCompare(a: Uint8Array, b: Uint8Array): boolean;
+
+interface Argon2Options {
+    t?: number;
+    m?: number;
+    p?: number;
+    dkLen?: number;
+}
+declare function deriveKeyFromPasswordArgon2(password: string, salt: Uint8Array, opts?: Argon2Options): Uint8Array;
+declare function generateSaltArgon2(): Uint8Array;
+declare function normalizeSignatureForKdf(signatureHex: string): string;
+declare function deriveKeyFromPasswordAndSignatureArgon2(password: string, signatureHex: string, salt: Uint8Array): Uint8Array;
+declare function deriveKeyFromPasswordAndSignatureLegacy(password: string, signatureHex: string, salt: Uint8Array): Uint8Array;
+
+declare function createKeyEnvelope(masterKey: Uint8Array, recipientPublicKeyHex: string): KeyEnvelope;
+declare function decryptKeyEnvelope(envelope: KeyEnvelope, recipientPrivateKeyHex: string): Uint8Array;
+
+declare function createEmptyVault(): Vault;
+declare function createEntry(entry: Omit<VaultEntry, "id">): VaultEntry;
+declare function addEntry(vault: Vault, entry: Omit<VaultEntry, "id">): Vault;
+declare function updateEntry(vault: Vault, id: string, updates: Partial<Omit<VaultEntry, "id">>): Vault;
+declare function removeEntry(vault: Vault, id: string): Vault;
+declare function createFolder(vault: Vault, name: string, parentId?: string | null): Vault;
+declare function renameFolder(vault: Vault, folderId: string, newName: string): Vault;
+declare function moveFolder(vault: Vault, folderId: string, newParentId: string | null): Vault;
+declare function deleteUserFolder(vault: Vault, folderId: string): Vault;
+declare function parseVault(json: string): Vault;
+declare function serializeVault(vault: Vault): string;
+declare function createExportPayload(vault: Vault, secretKey?: string): string;
+declare function updateEntryUseCount(vault: Vault, entryId: string, increment?: number): Promise<Vault>;
+declare function getMostUsedEntries(vault: Vault, count?: number): VaultEntry[];
+interface MergeImportStats {
+    added: number;
+    skipped: number;
+    enriched: number;
+}
+interface MergeImportResult {
+    entries: VaultEntry[];
+    stats: MergeImportStats;
+}
+declare function normalizeUrl(raw: string): string;
+declare function entryFingerprint(entry: {
+    url?: string;
+    username?: string;
+    password?: string;
+    notes?: string;
+    folder?: string;
+}): string;
+declare function mergeImportedEntries(existing: VaultEntry[], imported: VaultEntry[]): MergeImportResult;
+declare function deduplicateEntries(entries: VaultEntry[]): {
+    entries: VaultEntry[];
+    removed: number;
+};
+
+declare function createVaultPayload(vaultJson: string, walletPublicKeyHex: string): {
+    payload: VaultPayload;
+    masterKey: Uint8Array;
+};
+declare function parseVaultPayload(json: string): VaultPayload;
+
+declare const PAYLOAD_VERSION_V1 = 1;
+declare const PAYLOAD_VERSION_V2 = 2;
+declare const PAYLOAD_VERSION_V3 = 3;
+declare const PAYLOAD_VERSION_V4 = 4;
+declare const PAYLOAD_VERSION_CURRENT = 4;
+declare const MOBILE_MIN_PAYLOAD_VERSION = 3;
+declare const MOBILE_MAX_PAYLOAD_VERSION = 4;
+declare const EXTENSION_MIN_PAYLOAD_VERSION = 2;
+declare const EXTENSION_MAX_PAYLOAD_VERSION = 4;
+type PayloadVersion = typeof PAYLOAD_VERSION_V1 | typeof PAYLOAD_VERSION_V2 | typeof PAYLOAD_VERSION_V3 | typeof PAYLOAD_VERSION_V4;
+declare function isCurrentPayloadVersion(version: number): boolean;
+declare function isAcceptablePayloadVersion(version: number, platform: "mobile" | "extension"): boolean;
+
+interface SkippedItem {
+    source: string;
+    type: string;
+    name: string;
+    reason: string;
+}
+declare function isOnePasswordPif(content: string): boolean;
+declare function import1PasswordPif(content: string): Vault;
+declare function importBitwardenJson(json: string): Vault;
+declare function importCsv(csv: string): Vault;
+declare function isProtonPassExport(jsonStr: string): boolean;
+declare function importProtonPassJson(json: string): Vault;
+declare function encryptPgpContent(plaintext: string, passphrase: string): Promise<string>;
+declare function decryptPgpContent(encryptedContent: string | Uint8Array, passphrase: string): Promise<string>;
+interface PgpImportResult {
+    vault: Vault;
+    secretKey?: string;
+}
+declare function importFromPgp(encryptedContent: string | Uint8Array, passphrase: string, vaultKeeperPassword?: string): Promise<PgpImportResult>;
+interface ImportVaultTextResult {
+    vault: Vault;
+    skipped?: SkippedItem[];
+}
+declare function importVaultText(content: string | Uint8Array): Promise<ImportVaultTextResult>;
+
+interface EncryptedExportPayload {
+    version: number;
+    format: string;
+    salt: string;
+    nonce: string;
+    ciphertext: string;
+    commitment?: string;
+    exportedAt?: string;
+    secretKey?: string;
+    kdf?: {
+        name: string;
+        t: number;
+        m: number;
+        p: number;
+        dkLen: number;
+    };
+}
+declare function exportEncryptedVault(vault: Vault, password: string, secretKey?: string, argon2Opts?: Argon2Options, precomputed?: {
+    key: Uint8Array;
+    salt: Uint8Array;
+}): Promise<string>;
+declare function isEncryptedExport(jsonStr: string): boolean;
+interface EncryptedImportResult {
+    vault: Vault;
+    secretKey?: string;
+}
+declare function importEncryptedVault(encryptedJson: string, password: string, argon2Opts?: Argon2Options): Promise<EncryptedImportResult>;
+
+interface SkippedExport {
+    id: string;
+    title?: string;
+    folder?: string;
+    reason: string;
+}
+interface ExportResult {
+    content: string;
+    baseName: string;
+    mimeType: string;
+    extension: string;
+    skipped: SkippedExport[];
+}
+declare function exportCsv(vault: Vault, opts?: {
+    variant?: "chrome" | "bitwarden";
+}): ExportResult;
+declare function exportBitwardenJson(vault: Vault): ExportResult;
+declare function exportProtonPassJson(vault: Vault): ExportResult;
+
+declare function getChecksumAddress(address: string): string;
+
+type TOTPAlgorithm = "SHA-1" | "SHA-256" | "SHA-512";
+declare function getTOTPCode(secretBase32: string, algorithm?: TOTPAlgorithm, digits?: number, period?: number): string;
+declare function getTOTPRemainingSeconds(period?: number): number;
+declare function parseTOTPUri(uri: string): {
+    secret: string;
+    algorithm: TOTPAlgorithm;
+    digits: number;
+    period: number;
+    issuer?: string;
+    account?: string;
+} | null;
+
+type CardBrand = "visa" | "mastercard" | "amex" | "discover" | null;
+declare function digitsOnly(value: string): string;
+declare function getCardBrand(number: string): CardBrand;
+declare function getLast4(number: string): string;
+declare function maskCardNumber(number: string): string;
+declare function formatCardNumber(number: string, brand?: CardBrand | null): string;
+declare function formatCardDisplayMasked(rawDigits: string, brand?: CardBrand | null): string;
+declare const CARD_BRAND_LABELS: Record<NonNullable<CardBrand>, string>;
+
+type PwnedPasswordFetchOptions = {
+    signal?: AbortSignal;
+    fetchFn?: typeof fetch;
+};
+declare function getPwnedPasswordCount(password: string, options?: PwnedPasswordFetchOptions): Promise<number>;
+
+declare function uniformRandom(max: number): number;
+interface GeneratePasswordOptions {
+    length?: number;
+    upper?: boolean;
+    lower?: boolean;
+    numbers?: boolean;
+    symbols?: boolean;
+}
+declare function generatePassword(opts?: GeneratePasswordOptions): string;
+interface GeneratePassphraseOptions {
+    wordCount?: number;
+    separator?: string;
+    capitalize?: boolean;
+}
+declare function generatePassphrase(opts?: GeneratePassphraseOptions): string;
+
+interface ErrorReport {
+    ts: string;
+    component: string;
+    message: string;
+    stack: string | null;
+    runtime: "extension" | "ios" | "android" | "web";
+    version: string | null;
+}
+declare function captureError(error: Error | string, component: string, runtime: ErrorReport["runtime"], options?: {
+    stack?: string | null;
+    version?: string | null;
+}): ErrorReport;
+declare function getErrorBuffer(): readonly ErrorReport[];
+declare function clearErrorBuffer(): void;
+declare function formatErrorReport(): string;
+declare function sendErrorReport(endpoint: string, report?: ErrorReport): Promise<boolean>;
+
+interface EmailBreach {
+    name: string;
+    date: string;
+    description?: string;
+    logoPath?: string;
+    dataClasses?: string[];
+}
+interface EmailBreachResult {
+    email: string;
+    found: boolean;
+    breachCount: number;
+    breaches: EmailBreach[];
+    checked: boolean;
+    error?: string;
+}
+interface EmailBreachReport {
+    results: EmailBreachResult[];
+    breachedCount: number;
+    checkedCount: number;
+    totalCount: number;
+}
+declare function checkEmailBreaches(emails: string[], opts?: {
+    signal?: AbortSignal;
+    onProgress?: (result: EmailBreachResult, index: number, total: number) => void;
+}): Promise<EmailBreachReport>;
+
+type PasswordStrength = "critical" | "weak" | "fair" | "strong";
+interface PasswordHealthEntry {
+    entryId: string;
+    url: string;
+    username: string;
+    strength: PasswordStrength;
+    score: number;
+    issues: string[];
+    reusedWith: string[];
+    ageMonths: number | null;
+    expired: boolean;
+    twoFactorMissing: boolean;
+    unsecureUrl: boolean;
+}
+interface PasswordHealthReport {
+    entries: PasswordHealthEntry[];
+    overallScore: number;
+    stats: {
+        total: number;
+        critical: number;
+        weak: number;
+        fair: number;
+        strong: number;
+        reused: number;
+        empty: number;
+        expired: number;
+        twoFactorMissing: number;
+        unsecureWebsites: number;
+    };
+}
+declare function scorePassword(password: string): {
+    score: number;
+    strength: PasswordStrength;
+    issues: string[];
+};
+declare function analyzeVaultHealth(entries: VaultEntry[]): PasswordHealthReport;
+
+interface BreachResult {
+    entryId: string;
+    url: string;
+    username: string;
+    breachCount: number;
+    checked: boolean;
+    error?: string;
+}
+interface BreachReport {
+    results: BreachResult[];
+    breachedCount: number;
+    checkedCount: number;
+    totalCount: number;
+}
+declare function checkVaultBreaches(entries: VaultEntry[], opts?: {
+    signal?: AbortSignal;
+    onProgress?: (result: BreachResult, index: number, total: number) => void;
+    delayMs?: number;
+}): Promise<BreachReport>;
+
+interface PasskeyKeyPair {
+    privateKey: Uint8Array;
+    publicKey: Uint8Array;
+    publicKeyCose: Uint8Array;
+}
+declare function generatePasskeyKeyPair(): PasskeyKeyPair;
+declare function generateCredentialId(): Uint8Array;
+declare function publicKeyToCose(publicKey: Uint8Array): Uint8Array;
+declare const P256_SPKI_HEADER: Uint8Array<ArrayBuffer>;
+declare function publicKeyToSpki(publicKey: Uint8Array): Uint8Array;
+declare function signPasskeyAssertion(privateKey: Uint8Array, authenticatorData: Uint8Array, clientDataHash: Uint8Array): Uint8Array;
+declare function verifyPasskeyAssertion(publicKey: Uint8Array, authenticatorData: Uint8Array, clientDataHash: Uint8Array, signature: Uint8Array): boolean;
+declare function rpIdHash(rpId: string): Uint8Array;
+declare function buildAuthDataForCreate(rpId: string, credentialId: Uint8Array, publicKeyCose: Uint8Array, counter?: number): Uint8Array;
+declare function buildAuthDataForGet(rpId: string, counter: number, userVerification?: "required" | "preferred" | "discouraged"): Uint8Array;
+declare function buildAttestationObject(authData: Uint8Array): Uint8Array;
+declare function toBase64Url(bytes: Uint8Array): string;
+declare function fromBase64Url(str: string): Uint8Array;
+
+declare function encryptPasskeyPrivateKey(privateKey: Uint8Array, masterKey: Uint8Array, credentialId: string): string;
+declare function decryptPasskeyPrivateKey(encryptedHex: string, masterKey: Uint8Array, credentialId: string): Uint8Array;
+declare function isPasskeyPrivateKeyEncrypted(privateKeyHex: string): boolean;
+
+interface PasskeyPrfCredential {
+    credentialId: string;
+    prfSalt: string;
+    deviceName: string;
+    createdAt: string;
+    lastUsedAt?: string;
+    authenticatorType: "platform" | "cross-platform";
+}
+declare function isWebAuthnSupported(): boolean;
+declare function isPrfSupported(): Promise<boolean>;
+declare function generatePrfSalt(): Uint8Array;
+declare function deriveKeyFromPrfResult(prfOutput: Uint8Array): Uint8Array;
+declare function enrollPasskeyForPrf(userId: string, userName: string): Promise<{
+    credentialId: string;
+    prfSalt: string;
+    authenticatorType: "platform" | "cross-platform";
+} | null>;
+declare function deriveKeyFromPasskeyPrf(credentialId: string, prfSaltHex: string): Promise<Uint8Array | null>;
+
+type Argon2ProviderFn = (input: Uint8Array, salt: Uint8Array, opts: {
+    t: number;
+    m: number;
+    p: number;
+    dkLen: number;
+}) => Promise<Uint8Array> | Uint8Array;
+declare function setArgon2Provider(fn: Argon2ProviderFn): void;
+declare function getHiddenWalletLegacy(masterPassword: string, secretKey?: string): LocalAccount;
+declare function getHiddenWalletPrivateKey(masterPassword: string, secretKey?: string): Promise<`0x${string}`>;
+declare function getHiddenWalletFromPassword(masterPassword: string, secretKey?: string): Promise<LocalAccount>;
+declare function clearHiddenWalletCache(): void;
+declare const FRAGMENT_DOMAIN: {
+    readonly name: "VaultKeeperFragments";
+    readonly version: "1";
+    readonly chainId: 8453;
+};
+declare const FRAGMENT_TYPES: {
+    StoreFragmentMeta: {
+        name: string;
+        type: string;
+    }[];
+};
+declare function signStoreFragmentMeta(masterPassword: string, lookupIdHash: string, encryptedPayload: string, secretKey?: string): Promise<{
+    signature: string;
+    owner: string;
+}>;
+declare function signStoreFragmentMetaWithSigner(signer: {
+    signTypedData: (params: {
+        domain: typeof FRAGMENT_DOMAIN;
+        types: typeof FRAGMENT_TYPES;
+        primaryType: "StoreFragmentMeta";
+        message: Record<string, unknown>;
+    }) => Promise<`0x${string}`>;
+    address: `0x${string}`;
+}, lookupIdHash: string, encryptedPayload: string): Promise<{
+    signature: string;
+    owner: string;
+}>;
+
+declare function splitBuffer(data: Uint8Array, count: number): Uint8Array[];
+declare function mergeFragments(fragments: Uint8Array[]): Uint8Array;
+declare function encryptAndFragmentDocument(imageData: Uint8Array, masterKey: Uint8Array, fragmentCount?: number): Promise<{
+    fragments: Uint8Array[];
+    nonce: string;
+}>;
+declare function reassembleAndDecryptDocument(fragments: Uint8Array[], nonce: string, masterKey: Uint8Array): Promise<Uint8Array>;
+declare function generateBlurredThumbnailCanvas(imageBase64: string, targetWidth?: number): Promise<string>;
+declare function generateDocumentId(): string;
+
+interface MRZResult {
+    type: "TD1" | "TD2" | "TD3" | "FRENCH_CNI";
+    fullName: string;
+    surname: string;
+    givenNames: string;
+    documentNumber: string;
+    birthDate: string;
+    expiryDate?: string;
+    sex: "M" | "F" | "X";
+    nationality: string;
+    issuer: string;
+    valid: boolean;
+}
+declare function parseMRZ(lines: string[]): MRZResult | undefined;
+
+declare function calculateMrzChecksum(str: string): number;
+declare function cleanMrzField(str: string): string;
+declare function parseMrzDate(str: string): string;
+
+declare function deriveMrzKseed(docNumber: string, birthDate: string, expiryDate: string): Uint8Array;
+declare function deriveNfcKey(kseed: Uint8Array, counter: 1 | 2): Uint8Array;
+declare function buildMutualAuthData(_s: Uint8Array, _r: Uint8Array, _k: Uint8Array): Uint8Array;
+
+declare function generateNfcDeviceSecret(): Uint8Array;
+declare function encryptNfcPayload(masterPassword: string, deviceSecret: Uint8Array, pin: string): string;
+declare function decryptNfcPayload(payload: string, deviceSecret: Uint8Array, pin: string): string;
+declare function isNfcPayloadV2(payload: string): boolean;
+declare function isNfcPayloadV3(payload: string): boolean;
+declare function isNfcPayloadV1(payload: string): boolean;
+
+declare const SHARE_VERSION = 2;
+interface SharePayload {
+    version: typeof SHARE_VERSION;
+    type: "credentials" | "note" | "file" | "link" | "cloud_file";
+    username?: string;
+    password?: string;
+    url?: string;
+    totpSecret?: string;
+    noteTitle?: string;
+    noteContent?: string;
+    linkUrl?: string;
+    linkTitle?: string;
+    fileName?: string;
+    fileMimeType?: string;
+    fileData?: string;
+    fileSize?: number;
+    message?: string;
+    senderLabel?: string;
+    createdAt: number;
+}
+interface ShareCreationResult {
+    encryptedBlob: string;
+    shareId: string;
+    privateKeyHex: string;
+    publicKeyHex: string;
+    pin: string;
+    apiPinHash: string;
+}
+interface ShareOptions {
+    ttl: "1h" | "24h" | "7d";
+    maxViews: number;
+    senderLabel?: string;
+}
+declare function generateSharePin(): string;
+declare function computeApiPinHash(pin: string): string;
+declare function createSecureShare(payload: Omit<SharePayload, "version" | "createdAt">, pin?: string): ShareCreationResult;
+declare function decryptSecureShare(blobHex: string, keyHex: string, pin: string): SharePayload;
+declare function buildShareUrl(baseUrl: string, shareId: string, keyHex: string): string;
+declare function parseShareUrl(url: string): {
+    shareId: string;
+    publicKeyHex: string;
+} | null;
+declare function ttlToMs(ttl: "1h" | "24h" | "7d"): number;
+
+type PasswordStrengthLevel = "weak" | "medium" | "strong";
+interface PasswordStrengthResult {
+    score: number;
+    feedback: string[];
+    strength: PasswordStrengthLevel;
+}
+declare function calculatePasswordStrength(password: string): PasswordStrengthResult;
+
+declare function threeWayMerge(base: Vault | null | undefined, local: Vault, remote: Vault): Vault;
+declare function mergeFolders(base: string[] | null, local: string[], remote: string[], baseTombstones: Record<string, number>, localTombstones: Record<string, number>, remoteTombstones: Record<string, number>, now: number): {
+    names: string[];
+    tombstones: Record<string, number>;
+};
+declare function deleteFolder(vault: Vault, name: string, now?: number): Vault;
+declare function deleteCloudFolder(vault: Vault, name: string, now?: number): Vault;
+declare function deleteVaultEntry(vault: Vault, entryId: string, now?: number): Vault;
+declare function mergeFolderTrees(local: FolderNode[], remote: FolderNode[]): FolderNode[];
+
+declare const PAIR_URI_SCHEME = "vk-pair://";
+interface PairKeypair {
+    privateKey: Uint8Array;
+    publicKeyHex: string;
+}
+interface PairPayload {
+    version: 1;
+    vault: unknown;
+    masterPassword: string;
+    authType: "password" | "passkey";
+    walletAddress?: string;
+    licenseKey?: string;
+    secretKey?: string;
+    transferredAt: number;
+}
+interface ParsedPairUri {
+    sessionId: string;
+    publicKeyHex: string;
+}
+declare function generatePairKeypair(): PairKeypair;
+declare function derivePairSecret(myPrivateKey: Uint8Array, theirPublicKeyHex: string): Uint8Array;
+declare function encryptForPair(plaintext: string, sharedSecret: Uint8Array): string;
+declare function decryptFromPair(encryptedHex: string, sharedSecret: Uint8Array): string;
+declare const PAIR_SEND_URI_SCHEME = "vk-pair-send://";
+declare function buildPairUri(sessionId: string, publicKeyHex: string): string;
+declare function buildPairSendUri(sessionId: string, publicKeyHex: string): string;
+declare function parsePairUri(uri: string): ParsedPairUri | null;
+declare function parsePairSendUri(uri: string): ParsedPairUri | null;
+declare function isPairUri(uri: string): boolean;
+declare function isPairSendUri(uri: string): boolean;
+declare function buildPairPayload(vault: unknown, masterPassword: string, authType: "password" | "passkey", walletAddress?: string, licenseKey?: string, secretKey?: string): PairPayload;
+declare function parsePairPayload(json: string): PairPayload;
+
+declare const BIP39_WORDLIST: string[];
+declare function suggestBip39Words(prefix: string, limit?: number): string[];
+
+declare const EFF_WORDLIST: string[];
+
+interface PasswordEntropyResult {
+    entropyBits: number;
+    poolSize: number;
+    charsetEntropyBits: number;
+    dictionaryPenaltyBits: number;
+    patternPenaltyBits: number;
+    effectiveBits: number;
+    crackTimeDisplay: string;
+    strength: PasswordEntropyLevel;
+}
+type PasswordEntropyLevel = "critical" | "weak" | "fair" | "strong" | "excellent";
+declare function estimatePasswordEntropy(password: string): PasswordEntropyResult;
+
+interface AutoTagResult {
+    tags: Record<string, string[]>;
+}
+interface BreachSummaryResult {
+    severity: "low" | "medium" | "high" | "critical";
+    riskType: string;
+    summary: string;
+    dataAtRisk: string[];
+    actions: string[];
+    contextNote: string;
+}
+declare const VALID_TAGS: readonly ["banking", "social", "email", "shopping", "dev", "gaming", "streaming", "cloud", "education", "health", "travel", "government", "crypto", "news", "work", "other"];
+type ValidTag = typeof VALID_TAGS[number];
+declare const TAG_COLORS: Record<string, string>;
+declare function getTagColor(tag: string): string;
+declare class VaultKeepR_SLM {
+    constructor(_proxyUrl?: string);
+    private classifyDomain;
+    categorizeEntries(entries: {
+        id: string;
+        url: string;
+        username: string;
+    }[], _lang?: string, onProgress?: (done: number, total: number) => void): Promise<AutoTagResult>;
+    summarizeBreach(breachCount: number, siteUrl: string, lang?: string): Promise<BreachSummaryResult>;
+}
+
+export { type AutoTagResult, BIP39_WORDLIST, BUILTIN_FOLDER_IDS, BUILTIN_FOLDER_NODES, type BreachReport, type BreachResult, type BreachSummaryResult, CARD_BRAND_LABELS, type CardBrand, type CloudFile, type CloudFileCategory, type CustomField, DEFAULT_ENTRY_GROUP, DEFAULT_FRAGMENT_COUNT, type DocumentOcrData, EFF_WORDLIST, ENTRY_GROUP_IDS, ENTRY_GROUP_LABELS, EXTENSION_MAX_PAYLOAD_VERSION, EXTENSION_MIN_PAYLOAD_VERSION, type EmailBreach, type EmailBreachReport, type EmailBreachResult, type EncryptedExportPayload, type EncryptedFragmentPayload, type EncryptedImportResult, type EncryptedVault, type EntryGroupId, type ErrorReport, type ExportResult, FRAGMENTED_DEFAULT_THRESHOLD, FRAGMENTED_DEFAULT_TOTAL, type FolderNode, type FragmentDestination, type FragmentedConfig, type FragmentedManifest, type FragmentedPayload, type GeneratePassphraseOptions, type GeneratePasswordOptions, type ImportVaultTextResult, type KeyEnvelope, type LegacyContact, MOBILE_MAX_PAYLOAD_VERSION, MOBILE_MIN_PAYLOAD_VERSION, type MRZResult, type MergeImportResult, type MergeImportStats, P256_SPKI_HEADER, PAIR_SEND_URI_SCHEME, PAIR_URI_SCHEME, PAYLOAD_VERSION_CURRENT, PAYLOAD_VERSION_V1, PAYLOAD_VERSION_V2, PAYLOAD_VERSION_V3, PAYLOAD_VERSION_V4, type PairKeypair, type PairPayload, type ParsedPairUri, type PasskeyEntry, type PasskeyKeyPair, type PasskeyPrfCredential, type PasswordHealthEntry, type PasswordHealthReport, type PasswordStrength, type PasswordStrengthLevel, type PasswordStrengthResult, type PayloadVersion, type PgpImportResult, type PrfCredentialRecord, type PwnedPasswordFetchOptions, type SecureDocument, type SecureDocumentType, type SeedPhraseEntry, type ShareCreationResult, type ShareOptions, type SharePayload, type SkippedExport, type SkippedItem, TAG_COLORS, type TOTPAlgorithm, VALID_TAGS, type ValidTag, type Vault, type VaultEntry, type VaultEntryUri, type VaultEntryUriMatchType, VaultKeepR_SLM, type VaultPayload, addEntry, analyzeVaultHealth, buildAttestationObject, buildAuthDataForCreate, buildAuthDataForGet, buildMutualAuthData, buildPairPayload, buildPairSendUri, buildPairUri, buildShareUrl, calculateMrzChecksum, calculatePasswordStrength, captureError, checkEmailBreaches, checkVaultBreaches, cleanMrzField, clearErrorBuffer, clearHiddenWalletCache, compressVault, computeApiPinHash, createEmptyVault, createEntry, createExportPayload, createFolder, createKeyEnvelope, createSecureShare, createVaultPayload, decompressVault, decryptFromPair, decryptKeyEnvelope, decryptNfcPayload, decryptPasskeyPrivateKey, decryptPgpContent, decryptSecureShare, decryptVault, deduplicateEntries, deleteCloudFolder, deleteFolder, deleteUserFolder, deleteVaultEntry, deriveKeyFromPasskeyPrf, deriveKeyFromPasswordAndSignatureArgon2, deriveKeyFromPasswordAndSignatureLegacy, deriveKeyFromPasswordArgon2, deriveKeyFromPrfResult, deriveMrzKseed, deriveNfcKey, derivePairSecret, digitsOnly, encryptAndFragmentDocument, encryptForPair, encryptNfcPayload, encryptPasskeyPrivateKey, encryptPgpContent, encryptVault, enrollPasskeyForPrf, entryFingerprint, estimatePasswordEntropy, exportBitwardenJson, exportCsv, exportEncryptedVault, exportProtonPassJson, formatCardDisplayMasked, formatCardNumber, formatErrorReport, fromBase64Url, generateBlurredThumbnailCanvas, generateCredentialId, generateDocumentId, generateMasterKey, generateNfcDeviceSecret, generatePairKeypair, generatePasskeyKeyPair, generatePassphrase, generatePassword, generatePrfSalt, generateSaltArgon2, generateSharePin, getCardBrand, getChecksumAddress, getEntryGroupLabel, getErrorBuffer, getHiddenWalletFromPassword, getHiddenWalletLegacy, getHiddenWalletPrivateKey, getLast4, getMostUsedEntries, getPwnedPasswordCount, getTOTPCode, getTOTPRemainingSeconds, getTagColor, import1PasswordPif, importBitwardenJson, importCsv, importEncryptedVault, importFromPgp, importProtonPassJson, importVaultText, isAcceptablePayloadVersion, isCurrentPayloadVersion, isEncryptedExport, isNfcPayloadV1, isNfcPayloadV2, isNfcPayloadV3, isOnePasswordPif, isPairSendUri, isPairUri, isPasskeyPrivateKeyEncrypted, isPrfSupported, isProtonPassExport, isWebAuthnSupported, maskCardNumber, mergeFolderTrees, mergeFolders, mergeFragments, mergeImportedEntries, moveFolder, normalizeSignatureForKdf, normalizeUrl, parseMRZ, parseMrzDate, parsePairPayload, parsePairSendUri, parsePairUri, parseShareUrl, parseTOTPUri, parseVault, parseVaultPayload, publicKeyToCose, publicKeyToSpki, reassembleAndDecryptDocument, removeEntry, renameFolder, resolveFolderName, rpIdHash, scorePassword, secureCompare, secureWipe, sendErrorReport, serializeVault, setArgon2Provider, signPasskeyAssertion, signStoreFragmentMeta, signStoreFragmentMetaWithSigner, splitBuffer, suggestBip39Words, threeWayMerge, toBase64Url, ttlToMs, uniformRandom, updateEntry, updateEntryUseCount, verifyPasskeyAssertion };