import { type AnyTdfStream } from './tdf-stream.js';
import { PemKeyPair } from '../crypto/declarations.js';
import { AuthProvider, AppIdAuthProvider, HttpRequest } from '../../../src/auth/auth.js';
import EAS from '../../../src/auth/Eas.js';
import { EncryptParams, DecryptParams } from './builders.js';
import { Binary } from '../binary.js';
import { type DecoratedReadableStream } from './DecoratedReadableStream.js';
import { DecryptParamsBuilder, EncryptParamsBuilder } from './builders.js';
import { Policy } from '../models/index.js';
export interface ClientConfig {
    keypair?: PemKeyPair;
    organizationName?: string;
    clientId?: string;
    dpopEnabled?: boolean;
    kasEndpoint?: string;
    keyRewrapEndpoint?: string;
    keyUpsertEndpoint?: string;
    clientSecret?: string;
    oidcRefreshToken?: string;
    kasPublicKey?: string;
    oidcOrigin?: string;
    externalJwt?: string;
    authProvider?: AuthProvider | AppIdAuthProvider;
    readerUrl?: string;
    easEndpoint?: string;
    entityObjectEndpoint?: string;
}
export declare class Client {
    /**
     * Default kas endpoint, if present. Required for encrypt.
     */
    kasEndpoint?: string;
    kasPublicKey?: string;
    clientId?: string;
    authProvider?: AuthProvider | AppIdAuthProvider;
    readerUrl?: string;
    keypair?: PemKeyPair;
    signingKeys?: CryptoKeyPair;
    eas?: EAS;
    readonly dpopEnabled: boolean;
    clientConfig: ClientConfig;
    /**
     * An abstraction for protecting and accessing data using TDF3 services.
     * @param {Object} [config.keypair] - keypair generated for signing. Optional, will be generated by sdk if not passed
     * @param {String} [config.clientId]
     * @param {String} [config.kasEndpoint] - Key Access Server url
     * @param {String} [config.clientSecret] - Should be added ONLY for Node build
     * @param {String} [config.oidcRefreshToken] - After logging in to browser OIDC interface user
     * receives fresh token that needed by SDK for auth needs
     * @param {String} [config.externalJwt] - JWT from external authority (eg Google)
     * @param {String} [config.oidcOrigin] - Endpoint of authentication service
     */
    constructor(config: ClientConfig);
    /**
     * Encrypt plaintext into TDF ciphertext. One of the core operations of the Virtru SDK.
     *
     * @param {object} scope - dissem and attributes for constructing the policy
     * @param {object} source - nodeJS source object of unencrypted data
     * @param {boolean} [asHtml] - If we should wrap the TDF data in a self-opening HTML wrapper
     * @param {object} [metadata] - additional non-secret data to store with the TDF
     * @param {object} [opts] - object containing keypair
     * @param {string} [mimeType] - mime type of source
     * @param {boolean} [offline] - Where to store the policy
     * @param {object} [output] - output stream. Created and returned if not passed in
     * @param {object} [rcaSource] - RCA source information
     * @param {number} [windowSize] - segment size in bytes
     * @param {object} [eo] - entity object
     * @param {Binary} [payloadKey] - Separate key for payload
     * @return a {@link https://nodejs.org/api/stream.html#stream_class_stream_readable|Readable} a new stream containing the TDF ciphertext, if output is not passed in as a paramter
     * @see EncryptParamsBuilder
     */
    encrypt({ scope, source, asHtml, metadata, opts, mimeType, offline, output, rcaSource, windowSize, eo, payloadKey, }: EncryptParams): Promise<AnyTdfStream | null>;
    /**
     * Decrypt TDF ciphertext into plaintext. One of the core operations of the Virtru SDK.
     *
     * @param {object} - Required. All parameters for the decrypt operation, generated using {@link DecryptParamsBuilder#build|DecryptParamsBuilder's build()}.
     * @param {object} source - A data stream object, one of remote, stream, buffer, etc. types.
     * @param {object} opts - object with keypair
     * @param {object} [rcaSource] - RCA source information
     * @return a {@link https://nodejs.org/api/stream.html#stream_class_stream_readable|Readable} stream containing the decrypted plaintext.
     * @see DecryptParamsBuilder
     */
    decrypt({ source, opts, rcaSource }: DecryptParams): Promise<DecoratedReadableStream>;
    /**
     * Get the unique policyId associated with TDF ciphertext. Useful for managing authorization policies of encrypted data.
     * <br/><br/>
     * The policyId is embedded in the ciphertext so this is a local operation.
     *
     * @param {object} source - Required. TDF data stream,
     * generated using {@link DecryptParamsBuilder#build|DecryptParamsBuilder's build()}.
     * @return {string} - the unique policyId, which can be used for tracking purposes or policy management operations.
     * @see DecryptParamsBuilder
     */
    getPolicyId({ source }: any): Promise<any>;
    _createPolicyObject(scope: EncryptParams['scope']): Promise<Policy>;
    protected binaryToB64(binary: Binary): string;
    _getOrCreateKeypair(opts: undefined | {
        keypair: PemKeyPair;
    }): Promise<PemKeyPair>;
    _getOrFetchKasPubKey(): Promise<string>;
}
declare const _default: {
    Client: typeof Client;
    DecryptParamsBuilder: typeof DecryptParamsBuilder;
    EncryptParamsBuilder: typeof EncryptParamsBuilder;
    AuthProvider: typeof AuthProvider;
    AppIdAuthProvider: typeof AppIdAuthProvider;
    uploadBinaryToS3: (stream: ReadableStream<Uint8Array>, uploadUrl: string, fileSize: number) => Promise<void>;
    HttpRequest: typeof HttpRequest;
};
export default _default;
//# sourceMappingURL=index.d.ts.map