import { lib as KeetaNetLib } from '@keetanetwork/keetanet-client';
import { Buffer } from './utils/buffer.js';
import { KeetaAnchorError } from './error.js';
/**
 * Error codes for EncryptedContainer operations
 */
export declare const EncryptedContainerErrorCodes: readonly ["MALFORMED_BASE_FORMAT", "MALFORMED_VERSION", "MALFORMED_DATA_STRUCTURE", "MALFORMED_KEY_INFO", "MALFORMED_SIGNER_INFO", "UNSUPPORTED_VERSION", "UNSUPPORTED_CIPHER_ALGORITHM", "UNSUPPORTED_DIGEST_ALGORITHM", "UNSUPPORTED_SIGNATURE_ALGORITHM", "UNSUPPORTED_KEY_TYPE", "NO_KEYS_PROVIDED", "NO_MATCHING_KEY", "DECRYPTION_FAILED", "DECOMPRESSION_FAILED", "SIGNER_REQUIRES_PRIVATE_KEY", "NOT_SIGNED", "SIGNATURE_VERIFICATION_FAILED", "NO_PLAINTEXT_AVAILABLE", "NO_ENCODED_DATA_AVAILABLE", "PLAINTEXT_DISABLED", "ENCRYPTION_REQUIRED", "INVALID_PRINCIPALS", "ACCESS_MANAGEMENT_NOT_ALLOWED", "INTERNAL_ERROR"];
/**
 * Error code type
 */
export type EncryptedContainerErrorCode = typeof EncryptedContainerErrorCodes[number];
/**
 * Error class for EncryptedContainer operations
 */
export declare class EncryptedContainerError extends KeetaAnchorError {
    static readonly name: string;
    private readonly encryptedContainerErrorObjectTypeID;
    private static readonly encryptedContainerErrorObjectTypeID;
    readonly code: EncryptedContainerErrorCode;
    /**
     * Check if a string is a valid EncryptedContainerErrorCode
     */
    static isValidCode(code: string): code is EncryptedContainerErrorCode;
    constructor(code: EncryptedContainerErrorCode, message: string);
    static isInstance(input: unknown): input is EncryptedContainerError;
    toJSON(): ReturnType<KeetaAnchorError['toJSON']> & {
        code: EncryptedContainerErrorCode;
    };
    static fromJSON(input: unknown): Promise<EncryptedContainerError>;
}
declare const Account: typeof KeetaNetLib.Account;
type Account = InstanceType<typeof KeetaNetLib.Account>;
/**
 * Options for creating an EncryptedContainer from plaintext
 */
export type FromPlaintextOptions = {
    locked?: boolean;
    signer?: Account;
};
type CipherOptions = {
    /**
     * The symmetric cipher key (if any)
     */
    cipherKey: Buffer | undefined;
    /**
     * The symmetric cipher IV (if any)
     */
    cipherIV: Buffer | undefined;
    /**
     * The symmetric cipher algorithm
     */
    cipherAlgo: string;
};
type EncryptedContainerInfo = Pick<CipherOptions, 'cipherAlgo'> & {
    /**
     * Set of accounts which can access the data
     */
    principals: Account[];
};
type UnencryptedContainerInfo = {
    /**
     * Unencrypted container should not have any principals
     */
    principals: null;
};
export declare class EncryptedContainer {
    #private;
    private static readonly algorithm;
    /**
     * Encryption details
     */
    protected _internalState: EncryptedContainerInfo | UnencryptedContainerInfo;
    constructor(principals: Account[] | null, signer?: Account);
    get encrypted(): boolean;
    /**
     * Create an instance of the EncryptedContainer from an encrypted blob,
     * it will need to be decryptable with one of the specified principals
     *
     * After decryption happens, the list of principals with access to the
     * resource will be reset to what is contained within the encrypted
     * container
     */
    static fromEncryptedBuffer(data: ArrayBuffer | Buffer, principals: Account[]): EncryptedContainer;
    static fromEncodedBuffer(data: ArrayBuffer | Buffer, principals: Account[] | null): EncryptedContainer;
    /**
     * Create an instance of the EncryptedContainer from a plaintext.
     *
     * It will be decryptable by any one of the specified principals
     *
     * @param data The plaintext data to encrypt or encode
     * @param principals The list of principals who can access the data if it is null then the data is not encrypted
     * @param options Options including locked (plaintext accessibility) and signer (for RFC 5652 signing). For backward compatibility, can also be a boolean for locked.
     * @returns The EncryptedContainer instance with the plaintext data and principals set
     */
    static fromPlaintext(data: string | ArrayBuffer | Buffer, principals: Account[] | null, options?: boolean | FromPlaintextOptions): EncryptedContainer;
    /**
     * Set the plaintext buffer to the specified value
     */
    setPlaintext(data: string | ArrayBuffer | Buffer): void;
    private get _encoded();
    private get _plaintext();
    /**
     * Grant access to the secret for account(s) synchronously.  This
     * assumes the plaintext has already been computed and will fail
     * if it is not
     */
    grantAccessSync(accounts: Account[] | Account): this;
    /**
     * Grant access to the secret for account(s).
     */
    grantAccess(accounts: Account[] | Account): Promise<this>;
    /**
     * Revoke access to the secret for an account synchronously.  This
     * assumes the plaintext has already been computed and will fail
     * if it is not
     */
    revokeAccessSync(account: Account): this;
    /**
     * Revoke access to the secret for an account
     */
    revokeAccess(account: Account): Promise<this>;
    /**
     * Disable access to the plaintext from this instance
     */
    disablePlaintext(): this;
    /**
     * Get the plaintext for this instance
     */
    getPlaintext(): Promise<ArrayBuffer>;
    /**
     * Get the serializable buffer which can be stored and reconstructed
     */
    getEncodedBuffer(): Promise<ArrayBuffer>;
    /**
     * Get the list of accounts which have access to read the plaintext of
     * this container
     */
    get principals(): Account[];
    /**
     * Check if this container is signed
     */
    get isSigned(): boolean;
    /**
     * Get the signing account of this container.
     */
    getSigningAccount(): Account | undefined;
    /**
     * Verify the signature on this container.
     * This requires decrypting the container first to access the compressed plaintext.
     *
     * @returns true if signature is valid, false if invalid, or throws if not signed or plaintext unavailable
     */
    verifySignature(): Promise<boolean>;
}
export default EncryptedContainer;
//# sourceMappingURL=encrypted-container.d.ts.map