/**
* For creating a challenge.
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
*/
export class AcmeChallenge {
	free(): void;
	/**
	* Contains raw JSON data of this challenge. This is parsed by the underlying Rust library hence should not be accessed
	*/
	readonly delegate: Uint8Array;
	/**
	* Non-standard, Wire specific claim. Indicates the consumer from where it should get the challenge proof.
	* Either from wire-server "/access-token" endpoint in case of a DPoP challenge, or from an OAuth token endpoint for an OIDC challenge
	*/
	readonly target: string;
	/**
	* URL of this challenge
	*/
	readonly url: string;
}
/**
* Dump of the PKI environemnt as PEM
*/
export class E2eiDumpedPkiEnv {
	free(): void;
	/**
	* CRLs registered in the PKI env
	*/
	readonly crls: (string)[];
	/**
	* Intermediate CAs that are loaded
	*/
	readonly intermediates: (string)[];
	/**
	* Root CA in use (i.e. Trust Anchor)
	*/
	readonly root_ca: string;
}
/**
* Result of an authorization creation.
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5
*/
export class NewAcmeAuthz {
	free(): void;
	/**
	* Associated ACME Challenge
	*/
	readonly challenge: AcmeChallenge;
	/**
	* DNS entry associated with those challenge
	*/
	readonly identifier: string;
	/**
	* ACME challenge + ACME key thumbprint
	*/
	readonly keyauth: string | undefined;
}
/**
* Result of an order creation.
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
*/
export class NewAcmeOrder {
	free(): void;
	/**
	*/
	readonly authorizations: (Uint8Array)[];
	/**
	* Contains raw JSON data of this order. This is parsed by the underlying Rust library hence should not be accessed
	*/
	readonly delegate: Uint8Array;
}
/**
 * Error wrapper that takes care of extracting rich error details across the FFI (through JSON parsing)
 *
 * Whenever you're supposed to get this class (that extends `Error`) you might end up with a base `Error`
 * in case the parsing of the message structure fails. This is unlikely but the case is still covered and fall backs automatically.
 * More information will be found in the base `Error.cause` to inform you why the parsing has failed.
 *
 * Please note that in this case the extra properties will not be available.
 */
export declare class CoreCryptoError extends Error {
	rustStackTrace: string;
	proteusErrorCode: number;
	private constructor();
	private static fallback;
	static build(msg: string, ...params: any[]): CoreCryptoError | Error;
	static fromStdError(e: Error): CoreCryptoError | Error;
	static asyncMapErr<T>(p: Promise<T>): Promise<T>;
}
/**
 * see [core_crypto::prelude::CiphersuiteName]
 */
export declare enum Ciphersuite {
	/**
	 * DH KEM x25519 | AES-GCM 128 | SHA2-256 | Ed25519
	 */
	MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519 = 1,
	/**
	 * DH KEM P256 | AES-GCM 128 | SHA2-256 | EcDSA P256
	 */
	MLS_128_DHKEMP256_AES128GCM_SHA256_P256 = 2,
	/**
	 * DH KEM x25519 | Chacha20Poly1305 | SHA2-256 | Ed25519
	 */
	MLS_128_DHKEMX25519_CHACHA20POLY1305_SHA256_Ed25519 = 3,
	/**
	 * DH KEM x448 | AES-GCM 256 | SHA2-512 | Ed448
	 */
	MLS_256_DHKEMX448_AES256GCM_SHA512_Ed448 = 4,
	/**
	 * DH KEM P521 | AES-GCM 256 | SHA2-512 | EcDSA P521
	 */
	MLS_256_DHKEMP521_AES256GCM_SHA512_P521 = 5,
	/**
	 * DH KEM x448 | Chacha20Poly1305 | SHA2-512 | Ed448
	 */
	MLS_256_DHKEMX448_CHACHA20POLY1305_SHA512_Ed448 = 6,
	/**
	 * DH KEM P384 | AES-GCM 256 | SHA2-384 | EcDSA P384
	 */
	MLS_256_DHKEMP384_AES256GCM_SHA384_P384 = 7,
	/**
	 *  x25519Kyber768Draft00 Hybrid KEM | AES-GCM 128 | SHA2-256 | Ed25519
	 */
	MLS_128_X25519KYBER768DRAFT00_AES128GCM_SHA256_Ed25519 = 61489
}
export declare enum CredentialType {
	/**
	 * Just a KeyPair
	 */
	Basic = 1,
	/**
	 * A certificate obtained through e2e identity enrollment process
	 */
	X509 = 2
}
/**
 * Configuration object for new conversations
 */
export interface ConversationConfiguration {
	/**
	 * Conversation ciphersuite
	 */
	ciphersuite?: Ciphersuite;
	/**
	 * List of client IDs that are allowed to be external senders of commits
	 */
	externalSenders?: Uint8Array[];
	/**
	 * Implementation specific configuration
	 */
	custom?: CustomConfiguration;
}
/**
 * see [core_crypto::prelude::MlsWirePolicy]
 */
export declare enum WirePolicy {
	/**
	 * Handshake messages are never encrypted
	 */
	Plaintext = 1,
	/**
	 * Handshake messages are always encrypted
	 */
	Ciphertext = 2
}
/**
 * Implementation specific configuration object for a conversation
 */
export interface CustomConfiguration {
	/**
	 * Duration in seconds after which we will automatically force a self_update commit
	 * Note: This isn't currently implemented
	 */
	keyRotationSpan?: number;
	/**
	 * Defines if handshake messages are encrypted or not
	 * Note: Ciphertext is not currently supported by wire-server
	 */
	wirePolicy?: WirePolicy;
}
/**
 * Alias for conversation IDs.
 * This is a freeform, uninspected buffer.
 */
export type ConversationId = Uint8Array;
/**
 * Alias for client identifier.
 * This is a freeform, uninspected buffer.
 */
export type ClientId = Uint8Array;
/**
 * Alias for proposal reference. It is a byte array of size 16.
 */
export type ProposalRef = Uint8Array;
/**
 * Data shape for proteusNewPrekeyAuto() call returns.
 */
export interface ProteusAutoPrekeyBundle {
	/**
	 * Proteus PreKey id
	 *
	 * @readonly
	 */
	id: number;
	/**
	 * CBOR-serialized Proteus PreKeyBundle
	 *
	 * @readonly
	 */
	pkb: Uint8Array;
}
/**
 * Data shape for the returned MLS commit & welcome message tuple upon adding clients to a conversation
 */
export interface MemberAddedMessages {
	/**
	 * TLS-serialized MLS Commit that needs to be fanned out to other (existing) members of the conversation
	 *
	 * @readonly
	 */
	commit: Uint8Array;
	/**
	 * TLS-serialized MLS Welcome message that needs to be fanned out to the clients newly added to the conversation
	 *
	 * @readonly
	 */
	welcome: Uint8Array;
	/**
	 * MLS GroupInfo which is required for joining a group by external commit
	 *
	 * @readonly
	 */
	groupInfo: GroupInfoBundle;
	/**
	 * New CRL distribution points that appeared by the introduction of a new credential
	 */
	crlNewDistributionPoints?: string[];
}
/**
 * Data shape for a MLS generic commit + optional bundle (aka stapled commit & welcome)
 */
export interface CommitBundle {
	/**
	 * TLS-serialized MLS Commit that needs to be fanned out to other (existing) members of the conversation
	 *
	 * @readonly
	 */
	commit: Uint8Array;
	/**
	 * Optional TLS-serialized MLS Welcome message that needs to be fanned out to the clients newly added to the conversation
	 *
	 * @readonly
	 */
	welcome?: Uint8Array;
	/**
	 * MLS GroupInfo which is required for joining a group by external commit
	 *
	 * @readonly
	 */
	groupInfo: GroupInfoBundle;
}
/**
 * Wraps a GroupInfo in order to efficiently upload it to the Delivery Service.
 * This is not part of MLS protocol but parts might be standardized at some point.
 */
export interface GroupInfoBundle {
	/**
	 * see {@link GroupInfoEncryptionType}
	 */
	encryptionType: GroupInfoEncryptionType;
	/**
	 * see {@link RatchetTreeType}
	 */
	ratchetTreeType: RatchetTreeType;
	/**
	 * TLS-serialized GroupInfo
	 */
	payload: Uint8Array;
}
/**
 * Informs whether the GroupInfo is confidential
 * see [core_crypto::mls::conversation::group_info::GroupInfoEncryptionType]
 */
export declare enum GroupInfoEncryptionType {
	/**
	 * Unencrypted
	 */
	Plaintext = 1,
	/**
	 * Encrypted in a JWE (not yet implemented)
	 */
	JweEncrypted = 2
}
/**
 * Represents different ways of carrying the Ratchet Tree with some optimizations to save some space
 * see [core_crypto::mls::conversation::group_info::RatchetTreeType]
 */
export declare enum RatchetTreeType {
	/**
	 * Complete GroupInfo
	 */
	Full = 1,
	/**
	 * Contains the difference since previous epoch (not yet implemented)
	 */
	Delta = 2,
	/**
	 * To define (not yet implemented)
	 */
	ByRef = 3
}
/**
 * Result returned after rotating the Credential of the current client in all the local conversations
 */
export interface RotateBundle {
	/**
	 * An Update commit for each conversation
	 *
	 * @readonly
	 */
	commits: Map<string, CommitBundle>;
	/**
	 * Fresh KeyPackages with the new Credential
	 *
	 * @readonly
	 */
	newKeyPackages: Uint8Array[];
	/**
	 * All the now deprecated KeyPackages. Once deleted remotely, delete them locally with {@link CoreCrypto.deleteKeyPackages}
	 *
	 * @readonly
	 */
	keyPackageRefsToRemove: Uint8Array[];
	/**
	 * New CRL distribution points that appeared by the introduction of a new credential
	 */
	crlNewDistributionPoints?: string[];
}
/**
 * Params for CoreCrypto deferred initialization
 * Please note that the `entropySeed` parameter MUST be exactly 32 bytes
 */
export interface CoreCryptoDeferredParams {
	/**
	 * Name of the IndexedDB database
	 */
	databaseName: string;
	/**
	 * Encryption master key
	 * This should be appropriately stored in a secure location (i.e. WebCrypto private key storage)
	 */
	key: string;
	/**
	 * All the ciphersuites this MLS client can support
	 */
	ciphersuites: Ciphersuite[];
	/**
	 * External PRNG entropy pool seed.
	 * This **must** be exactly 32 bytes
	 */
	entropySeed?: Uint8Array;
	/**
	 * .wasm file path, this will be useful in case your bundling system likes to relocate files (i.e. what webpack does)
	 */
	wasmFilePath?: string;
	/**
	 * Number of initial KeyPackage to create when initializing the client
	 */
	nbKeyPackage?: number;
}
/**
 * Params for CoreCrypto initialization
 * Please note that the `entropySeed` parameter MUST be exactly 32 bytes
 */
export interface CoreCryptoParams extends CoreCryptoDeferredParams {
	/**
	 * MLS Client ID.
	 * This should stay consistent as it will be verified against the stored signature & identity to validate the persisted credential
	 */
	clientId: ClientId;
}
export interface ConversationInitBundle {
	/**
	 * Conversation ID of the conversation created
	 *
	 * @readonly
	 */
	conversationId: ConversationId;
	/**
	 * TLS-serialized MLS External Commit that needs to be fanned out
	 *
	 * @readonly
	 */
	commit: Uint8Array;
	/**
	 * MLS Public Group State (aka Group Info) which becomes valid when the external commit is accepted by the Delivery Service
	 * with {@link CoreCrypto.mergePendingGroupFromExternalCommit}
	 *
	 * @readonly
	 */
	groupInfo: GroupInfoBundle;
	/**
	 * New CRL distribution points that appeared by the introduction of a new credential
	 */
	crlNewDistributionPoints?: string[];
}
/**
 *  Supporting struct for CRL registration result
 */
export interface CRLRegistration {
	/**
	 * Whether this CRL modifies the old CRL (i.e. has a different revocated cert list)
	 *
	 * @readonly
	 */
	dirty: boolean;
	/**
	 * Optional expiration timestamp
	 *
	 * @readonly
	 */
	expiration?: number;
}
/**
 * This is a wrapper for all the possible outcomes you can get after decrypting a message
 */
export interface DecryptedMessage {
	/**
	 * Raw decrypted application message, if the decrypted MLS message is an application message
	 */
	message?: Uint8Array;
	/**
	 * Only when decrypted message is a commit, CoreCrypto will renew local proposal which could not make it in the commit.
	 * This will contain either:
	 *   * local pending proposal not in the accepted commit
	 *   * If there is a pending commit, its proposals which are not in the accepted commit
	 */
	proposals: ProposalBundle[];
	/**
	 * It is set to false if ingesting this MLS message has resulted in the client being removed from the group (i.e. a Remove commit)
	 */
	isActive: boolean;
	/**
	 * Commit delay hint (in milliseconds) to prevent clients from hammering the server with epoch changes
	 */
	commitDelay?: number;
	/**
	 * Client identifier of the sender of the message being decrypted. Only present for application messages.
	 */
	senderClientId?: ClientId;
	/**
	 * true when the decrypted message resulted in an epoch change i.e. it was a commit
	 */
	hasEpochChanged: boolean;
	/**
	 * Identity claims present in the sender credential
	 * Only present when the credential is a x509 certificate
	 * Present for all messages
	 */
	identity?: WireIdentity;
	/**
	 * Only set when the decrypted message is a commit.
	 * Contains buffered messages for next epoch which were received before the commit creating the epoch
	 * because the DS did not fan them out in order.
	 */
	bufferedMessages?: BufferedDecryptedMessage[];
	/**
	 * New CRL distribution points that appeared by the introduction of a new credential
	 */
	crlNewDistributionPoints?: string[];
}
/**
 * Almost same as {@link DecryptedMessage} but avoids recursion
 */
export interface BufferedDecryptedMessage {
	/**
	 * see {@link DecryptedMessage.message}
	 */
	message?: Uint8Array;
	/**
	 * see {@link DecryptedMessage.proposals}
	 */
	proposals: ProposalBundle[];
	/**
	 * see {@link DecryptedMessage.isActive}
	 */
	isActive: boolean;
	/**
	 * see {@link DecryptedMessage.commitDelay}
	 */
	commitDelay?: number;
	/**
	 * see {@link DecryptedMessage.senderClientId}
	 */
	senderClientId?: ClientId;
	/**
	 * see {@link DecryptedMessage.hasEpochChanged}
	 */
	hasEpochChanged: boolean;
	/**
	 * see {@link DecryptedMessage.identity}
	 */
	identity?: WireIdentity;
	/**
	 * see {@link DecryptedMessage.crlNewDistributionPoints}
	 */
	crlNewDistributionPoints?: string[];
}
/**
 * Represents the identity claims identifying a client
 * Those claims are verifiable by any member in the group
 */
export interface WireIdentity {
	/**
	 * Unique client identifier
	 */
	clientId: string;
	/**
	 * Status of the Credential at the moment T when this object is created
	 */
	status: DeviceStatus;
	/**
	 * MLS thumbprint
	 */
	thumbprint: string;
	/**
	 * Indicates whether the credential is Basic or X509
	 */
	credentialType: CredentialType;
	/**
	 * In case {@link credentialType} is {@link CredentialType.X509} this is populated
	 */
	x509Identity?: X509Identity;
}
/**
 * Represents the parts of {@link WireIdentity} that are specific to a X509 certificate (and not a Basic one).
 */
export interface X509Identity {
	/**
	 * User handle e.g. `john_wire`
	 */
	handle: string;
	/**
	 * Name as displayed in the messaging application e.g. `John Fitzgerald Kennedy`
	 */
	displayName: string;
	/**
	 * DNS domain for which this identity proof was generated e.g. `whitehouse.gov`
	 */
	domain: string;
	/**
	 * X509 certificate identifying this client in the MLS group ; PEM encoded
	 */
	certificate: string;
	/**
	 * X509 certificate serial number
	 */
	serialNumber: string;
	/**
	 * X509 certificate not before as Unix timestamp
	 */
	notBefore: bigint;
	/**
	 * X509 certificate not after as Unix timestamp
	 */
	notAfter: bigint;
}
export interface AcmeDirectory {
	/**
	 * URL for fetching a new nonce. Use this only for creating a new account.
	 */
	newNonce: string;
	/**
	 * URL for creating a new account.
	 */
	newAccount: string;
	/**
	 * URL for creating a new order.
	 */
	newOrder: string;
	/**
	 * Revocation URL
	 */
	revokeCert: string;
}
/**
 * Indicates the standalone status of a device Credential in a MLS group at a moment T.
 * This does not represent the states where a device is not using MLS or is not using end-to-end identity
 */
export declare enum DeviceStatus {
	/**
	 * All is fine
	 */
	Valid = 1,
	/**
	 * The Credential's certificate is expired
	 */
	Expired = 2,
	/**
	 * The Credential's certificate is revoked
	 */
	Revoked = 3
}
/**
 * Returned by all methods creating proposals. Contains a proposal message and an identifier to roll back the proposal
 */
export interface ProposalBundle {
	/**
	 * TLS-serialized MLS proposal that needs to be fanned out to other (existing) members of the conversation
	 *
	 * @readonly
	 */
	proposal: Uint8Array;
	/**
	 * Unique identifier of a proposal. Use this in {@link CoreCrypto.clearPendingProposal} to roll back (delete) the proposal
	 *
	 * @readonly
	 */
	proposalRef: ProposalRef;
	/**
	 *  New CRL Distribution of members of this group
	 *
	 * @readonly
	 */
	crlNewDistributionPoints?: string[];
}
export interface WelcomeBundle {
	/**
	 * Conversation ID
	 *
	 * @readonly
	 */
	id: Uint8Array;
	/**
	 *  New CRL Distribution of members of this group
	 *
	 * @readonly
	 */
	crlNewDistributionPoints?: string[];
}
/**
 * MLS Proposal type
 */
export declare enum ProposalType {
	/**
	 * This allows to propose the addition of other clients to the MLS group/conversation
	 */
	Add = 0,
	/**
	 * This allows to propose the removal of clients from the MLS group/conversation
	 */
	Remove = 1,
	/**
	 * This allows to propose to update the client keying material (i.e. keypackage rotation) and the group root key
	 */
	Update = 2
}
/**
 * Common arguments for proposals
 */
export interface ProposalArgs {
	/**
	 * Conversation ID that is targeted by the proposal
	 */
	conversationId: ConversationId;
}
/**
 * Arguments for a proposal of type `Add`
 */
export interface AddProposalArgs extends ProposalArgs {
	/**
	 * TLS-serialized MLS KeyPackage to be added
	 */
	kp: Uint8Array;
}
/**
 * Arguments for a proposal of type `Remove`
 */
export interface RemoveProposalArgs extends ProposalArgs {
	/**
	 * Client ID to be removed from the conversation
	 */
	clientId: ClientId;
}
/**
 * MLS External Proposal type
 */
export declare enum ExternalProposalType {
	/**
	 * This allows to propose the addition of other clients to the MLS group/conversation
	 */
	Add = 0
}
export interface ExternalProposalArgs {
	/**
	 * Conversation ID that is targeted by the external proposal
	 */
	conversationId: ConversationId;
	/**
	 * MLS Group epoch for the external proposal.
	 * This needs to be the current epoch of the group or this proposal **will** be rejected
	 */
	epoch: number;
}
export interface ExternalAddProposalArgs extends ExternalProposalArgs {
	/**
	 * {@link Ciphersuite} to propose to join the MLS group with.
	 */
	ciphersuite: Ciphersuite;
	/**
	 * Fails when it is {@link CredentialType.X509} and no Credential has been created
	 * for it beforehand with {@link CoreCrypto.e2eiMlsInit} or variants.
	 */
	credentialType: CredentialType;
}
export interface CoreCryptoCallbacks {
	/**
	 * This callback is called by CoreCrypto to know whether a given clientId is authorized to "write"
	 * in the given conversationId. Think of it as a "isAdmin" callback conceptually
	 *
	 * This callback exists because there are many business cases where CoreCrypto doesn't have enough knowledge
	 * (such as what can exist on a backend) to inform the decision
	 *
	 * @param conversationId - id of the group/conversation
	 * @param clientId - id of the client performing an operation requiring authorization
	 * @returns whether the user is authorized by the logic layer to perform the operation
	 */
	authorize: (conversationId: Uint8Array, clientId: Uint8Array) => Promise<boolean>;
	/**
	 * A mix between {@link authorize} and {@link clientIsExistingGroupUser}. We currently use this callback to verify
	 * external commits to join a group ; in such case, the client has to:
	 * * first, belong to a user which is already in the MLS group (similar to {@link clientIsExistingGroupUser})
	 * * then, this user should be authorized to "write" in the given conversation (similar to {@link authorize})
	 *
	 * @param conversationId - id of the group/conversation
	 * @param externalClientId - id of the client performing an operation requiring authorization
	 * @param existingClients - all the clients currently within the MLS group
	 * @returns true if the external client is authorized to write to the conversation
	 */
	userAuthorize: (conversationId: Uint8Array, externalClientId: Uint8Array, existingClients: Uint8Array[]) => Promise<boolean>;
	/**
	 * Callback to ensure that the given `clientId` belongs to one of the provided `existingClients`
	 * This basically allows to defer the client ID parsing logic to the caller - because CoreCrypto is oblivious to such things
	 *
	 * @param conversationId - id of the group/conversation
	 * @param clientId - id of a client
	 * @param existingClients - all the clients currently within the MLS group
	 */
	clientIsExistingGroupUser: (conversationId: Uint8Array, clientId: Uint8Array, existingClients: Uint8Array[], parent_conversation_clients?: Uint8Array[]) => Promise<boolean>;
}
/**
 * Wrapper for the WASM-compiled version of CoreCrypto
 */
export declare class CoreCrypto {
	#private;
	/**
	 * Should only be used internally
	 */
	inner(): unknown;
	/**
	 * This is your entrypoint to initialize {@link CoreCrypto}!
	 *
	 * @param params - {@link CoreCryptoParams}
	 *
	 * @example
	 * ## Simple init
	 * ```ts
	 * const cc = await CoreCrypto.init({ databaseName: "test", key: "test", clientId: "test" });
	 * // Do the rest with `cc`
	 * ```
	 *
	 * ## Custom Entropy seed init & wasm file location
	 * ```ts
	 * // FYI, this is the IETF test vector #1
	 * const entropySeed = Uint32Array.from([
	 *   0xade0b876, 0x903df1a0, 0xe56a5d40, 0x28bd8653,
	 *   0xb819d2bd, 0x1aed8da0, 0xccef36a8, 0xc70d778b,
	 *   0x7c5941da, 0x8d485751, 0x3fe02477, 0x374ad8b8,
	 *   0xf4b8436a, 0x1ca11815, 0x69b687c3, 0x8665eeb2,
	 * ]);
	 *
	 * const wasmFilePath = "/long/complicated/path/on/webserver/whatever.wasm";
	 *
	 * const cc = await CoreCrypto.init({
	 *   databaseName: "test",
	 *   key: "test",
	 *   clientId: "test",
	 *   entropySeed,
	 *   wasmFilePath,
	 * });
	 * ````
	 */
	static init({ databaseName, key, clientId, wasmFilePath, ciphersuites, entropySeed, nbKeyPackage, }: CoreCryptoParams): Promise<CoreCrypto>;
	/**
	 * Almost identical to {@link CoreCrypto.init} but allows a 2 phase initialization of MLS.
	 * First, calling this will set up the keystore and will allow generating proteus prekeys.
	 * Then, those keys can be traded for a clientId.
	 * Use this clientId to initialize MLS with {@link CoreCrypto.mlsInit}.
	 * @param params - {@link CoreCryptoDeferredParams}
	 */
	static deferredInit({ databaseName, key, ciphersuites, entropySeed, wasmFilePath, nbKeyPackage, }: CoreCryptoDeferredParams): Promise<CoreCrypto>;
	/**
	 * Use this after {@link CoreCrypto.deferredInit} when you have a clientId. It initializes MLS.
	 *
	 * @param clientId - {@link CoreCryptoParams#clientId} but required
	 * @param ciphersuites - All the ciphersuites supported by this MLS client
	 * @param nbKeyPackage - number of initial KeyPackage to create when initializing the client
	 */
	mlsInit(clientId: ClientId, ciphersuites: Ciphersuite[], nbKeyPackage?: number): Promise<void>;
	/**
	 * Generates a MLS KeyPair/CredentialBundle with a temporary, random client ID.
	 * This method is designed to be used in conjunction with {@link CoreCrypto.mlsInitWithClientId} and represents the first step in this process
	 *
	 * @param ciphersuites - All the ciphersuites supported by this MLS client
	 * @returns This returns the TLS-serialized identity key (i.e. the signature keypair's public key)
	 */
	mlsGenerateKeypair(ciphersuites: Ciphersuite[]): Promise<Uint8Array[]>;
	/**
	 * Updates the current temporary Client ID with the newly provided one. This is the second step in the externally-generated clients process
	 *
	 * Important: This is designed to be called after {@link CoreCrypto.mlsGenerateKeypair}
	 *
	 * @param clientId - The newly-allocated client ID by the MLS Authentication Service
	 * @param signaturePublicKeys - The public key you were given at the first step; This is for authentication purposes
	 * @param ciphersuites - All the ciphersuites supported by this MLS client
	 */
	mlsInitWithClientId(clientId: ClientId, signaturePublicKeys: Uint8Array[], ciphersuites: Ciphersuite[]): Promise<void>;
	/** @hidden */
	private constructor();
	/**
	 * If this returns `true` you **cannot** call {@link CoreCrypto.wipe} or {@link CoreCrypto.close} as they will produce an error because of the
	 * outstanding references that were detected.
	 *
	 * @returns the count of strong refs for this CoreCrypto instance
	 */
	isLocked(): boolean;
	/**
	 * Wipes the {@link CoreCrypto} backing storage (i.e. {@link https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API | IndexedDB} database)
	 *
	 * **CAUTION**: This {@link CoreCrypto} instance won't be useable after a call to this method, but there's no way to express this requirement in TypeScript so you'll get errors instead!
	 */
	wipe(): Promise<void>;
	/**
	 * Closes this {@link CoreCrypto} instance and deallocates all loaded resources
	 *
	 * **CAUTION**: This {@link CoreCrypto} instance won't be usable after a call to this method, but there's no way to express this requirement in TypeScript, so you'll get errors instead!
	 */
	close(): Promise<void>;
	/**
	 * Registers the callbacks for CoreCrypto to use in order to gain additional information
	 *
	 * @param callbacks - Any interface following the {@link CoreCryptoCallbacks} interface
	 */
	registerCallbacks(callbacks: CoreCryptoCallbacks, ctx?: any): Promise<void>;
	/**
	 * Checks if the Client is member of a given conversation and if the MLS Group is loaded up
	 *
	 * @returns Whether the given conversation ID exists
	 *
	 * @example
	 * ```ts
	 *  const cc = await CoreCrypto.init({ databaseName: "test", key: "test", clientId: "test" });
	 *  const encoder = new TextEncoder();
	 *  if (await cc.conversationExists(encoder.encode("my super chat"))) {
	 *    // Do something
	 *  } else {
	 *    // Do something else
	 *  }
	 * ```
	 */
	conversationExists(conversationId: ConversationId): Promise<boolean>;
	/**
	 * Marks a conversation as child of another one
	 * This will mostly affect the behavior of the callbacks (the parentConversationClients parameter will be filled)
	 *
	 * @param childId - conversation identifier of the child conversation
	 * @param parentId - conversation identifier of the parent conversation
	 */
	markConversationAsChildOf(childId: ConversationId, parentId: ConversationId): Promise<void>;
	/**
	 * Returns the current epoch of a conversation
	 *
	 * @returns the epoch of the conversation
	 *
	 * @example
	 * ```ts
	 *  const cc = await CoreCrypto.init({ databaseName: "test", key: "test", clientId: "test" });
	 *  const encoder = new TextEncoder();
	 *  console.log(await cc.conversationEpoch(encoder.encode("my super chat")))
	 * ```
	 */
	conversationEpoch(conversationId: ConversationId): Promise<number>;
	/**
	 * Wipes and destroys the local storage of a given conversation / MLS group
	 *
	 * @param conversationId - The ID of the conversation to remove
	 */
	wipeConversation(conversationId: ConversationId): Promise<void>;
	/**
	 * Creates a new conversation with the current client being the sole member
	 * You will want to use {@link CoreCrypto.addClientsToConversation} afterwards to add clients to this conversation
	 *
	 * @param conversationId - The conversation ID; You can either make them random or let the backend attribute MLS group IDs
	 * @param creatorCredentialType - kind of credential the creator wants to create the group with
	 * @param configuration - configuration of the MLS group
	 * @param configuration.ciphersuite - The {@link Ciphersuite} that is chosen to be the group's
	 * @param configuration.externalSenders - Array of Client IDs that are qualified as external senders within the group
	 * @param configuration.custom - {@link CustomConfiguration}
	 */
	createConversation(conversationId: ConversationId, creatorCredentialType: CredentialType, configuration?: ConversationConfiguration): Promise<any>;
	/**
	 * Decrypts a message for a given conversation.
	 *
	 * Note: you should catch & ignore the following error reasons:
	 * * "We already decrypted this message once"
	 * * "You tried to join with an external commit but did not merge it yet. We will reapply this message for you when you merge your external commit"
	 * * "Incoming message is for a future epoch. We will buffer it until the commit for that epoch arrives"
	 *
	 * @param conversationId - The ID of the conversation
	 * @param payload - The encrypted message buffer
	 *
	 * @returns a {@link DecryptedMessage}. Note that {@link DecryptedMessage#message} is `undefined` when the encrypted payload contains a system message such a proposal or commit
	 */
	decryptMessage(conversationId: ConversationId, payload: Uint8Array): Promise<DecryptedMessage>;
	/**
	 * Encrypts a message for a given conversation
	 *
	 * @param conversationId - The ID of the conversation
	 * @param message - The plaintext message to encrypt
	 *
	 * @returns The encrypted payload for the given group. This needs to be fanned out to the other members of the group.
	 */
	encryptMessage(conversationId: ConversationId, message: Uint8Array): Promise<Uint8Array>;
	/**
	 * Ingest a TLS-serialized MLS welcome message to join an existing MLS group
	 *
	 * Important: you have to catch the error with this reason "Although this Welcome seems valid, the local KeyPackage
	 * it references has already been deleted locally. Join this group with an external commit", ignore it and then try
	 * to join this group with an external commit.
	 *
	 * @param welcomeMessage - TLS-serialized MLS Welcome message
	 * @param configuration - configuration of the MLS group
	 * @returns The conversation ID of the newly joined group. You can use the same ID to decrypt/encrypt messages
	 */
	processWelcomeMessage(welcomeMessage: Uint8Array, configuration?: CustomConfiguration): Promise<WelcomeBundle>;
	/**
	 * Get the client's public signature key. To upload to the DS for further backend side validation
	 *
	 * @param ciphersuite - of the signature key to get
	 * @param credentialType - of the public key to look for
	 * @returns the client's public signature key
	 */
	clientPublicKey(ciphersuite: Ciphersuite, credentialType: CredentialType): Promise<Uint8Array>;
	/**
	 *
	 * @param ciphersuite - of the KeyPackages to count
	 * @param credentialType - of the KeyPackages to count
	 * @returns The amount of valid, non-expired KeyPackages that are persisted in the backing storage
	 */
	clientValidKeypackagesCount(ciphersuite: Ciphersuite, credentialType: CredentialType): Promise<number>;
	/**
	 * Fetches a requested amount of keypackages
	 *
	 * @param ciphersuite - of the KeyPackages to generate
	 * @param credentialType - of the KeyPackages to generate
	 * @param amountRequested - The amount of keypackages requested
	 * @returns An array of length `amountRequested` containing TLS-serialized KeyPackages
	 */
	clientKeypackages(ciphersuite: Ciphersuite, credentialType: CredentialType, amountRequested: number): Promise<Array<Uint8Array>>;
	/**
	 * Prunes local KeyPackages after making sure they also have been deleted on the backend side
	 * You should only use this after {@link CoreCrypto.e2eiRotateAll}
	 *
	 * @param refs - KeyPackage references to delete obtained from a {RotateBundle}
	 */
	deleteKeypackages(refs: Uint8Array[]): Promise<void>;
	/**
	 * Adds new clients to a conversation, assuming the current client has the right to add new clients to the conversation.
	 *
	 * **CAUTION**: {@link CoreCrypto.commitAccepted} **HAS TO** be called afterward **ONLY IF** the Delivery Service responds
	 * '200 OK' to the {@link CommitBundle} upload. It will "merge" the commit locally i.e. increment the local group
	 * epoch, use new encryption secrets etc...
	 *
	 * @param conversationId - The ID of the conversation
	 * @param keyPackages - KeyPackages of the new clients to add
	 *
	 * @returns A {@link CommitBundle}
	 */
	addClientsToConversation(conversationId: ConversationId, keyPackages: Uint8Array[]): Promise<MemberAddedMessages>;
	/**
	 * Removes the provided clients from a conversation; Assuming those clients exist and the current client is allowed
	 * to do so, otherwise this operation does nothing.
	 *
	 * **CAUTION**: {@link CoreCrypto.commitAccepted} **HAS TO** be called afterward **ONLY IF** the Delivery Service responds
	 * '200 OK' to the {@link CommitBundle} upload. It will "merge" the commit locally i.e. increment the local group
	 * epoch, use new encryption secrets etc...
	 *
	 * @param conversationId - The ID of the conversation
	 * @param clientIds - Array of Client IDs to remove.
	 *
	 * @returns A {@link CommitBundle}
	 */
	removeClientsFromConversation(conversationId: ConversationId, clientIds: ClientId[]): Promise<CommitBundle>;
	/**
	 * Creates an update commit which forces every client to update their LeafNode in the conversation
	 *
	 * **CAUTION**: {@link CoreCrypto.commitAccepted} **HAS TO** be called afterward **ONLY IF** the Delivery Service responds
	 * '200 OK' to the {@link CommitBundle} upload. It will "merge" the commit locally i.e. increment the local group
	 * epoch, use new encryption secrets etc...
	 *
	 * @param conversationId - The ID of the conversation
	 *
	 * @returns A {@link CommitBundle}
	 */
	updateKeyingMaterial(conversationId: ConversationId): Promise<CommitBundle>;
	/**
	 * Commits the local pending proposals and returns the {@link CommitBundle} object containing what can result from this operation.
	 *
	 * **CAUTION**: {@link CoreCrypto.commitAccepted} **HAS TO** be called afterwards **ONLY IF** the Delivery Service responds
	 * '200 OK' to the {@link CommitBundle} upload. It will "merge" the commit locally i.e. increment the local group
	 * epoch, use new encryption secrets etc...
	 *
	 * @param conversationId - The ID of the conversation
	 *
	 * @returns A {@link CommitBundle} or `undefined` when there was no pending proposal to commit
	 */
	commitPendingProposals(conversationId: ConversationId): Promise<CommitBundle | undefined>;
	/**
	 * Creates a new proposal for the provided Conversation ID
	 *
	 * @param proposalType - The type of proposal, see {@link ProposalType}
	 * @param args - The arguments of the proposal, see {@link ProposalArgs}, {@link AddProposalArgs} or {@link RemoveProposalArgs}
	 *
	 * @returns A {@link ProposalBundle} containing the Proposal and its reference in order to roll it back if necessary
	 */
	newProposal(proposalType: ProposalType, args: ProposalArgs | AddProposalArgs | RemoveProposalArgs): Promise<ProposalBundle>;
	/**
	 * Creates a new external Add proposal for self client to join a conversation.
	 */
	newExternalProposal(externalProposalType: ExternalProposalType, args: ExternalAddProposalArgs): Promise<Uint8Array>;
	/**
	 * Allows to create an external commit to "apply" to join a group through its GroupInfo.
	 *
	 * If the Delivery Service accepts the external commit, you have to {@link CoreCrypto.mergePendingGroupFromExternalCommit}
	 * in order to get back a functional MLS group. On the opposite, if it rejects it, you can either retry by just
	 * calling again {@link CoreCrypto.joinByExternalCommit}, no need to {@link CoreCrypto.clearPendingGroupFromExternalCommit}.
	 * If you want to abort the operation (too many retries or the user decided to abort), you can use
	 * {@link CoreCrypto.clearPendingGroupFromExternalCommit} in order not to bloat the user's storage but nothing
	 * bad can happen if you forget to except some storage space wasted.
	 *
	 * @param groupInfo - a TLS encoded GroupInfo fetched from the Delivery Service
	 * @param credentialType - kind of Credential to use for joining this group. If {@link CredentialType.Basic} is
	 * chosen and no Credential has been created yet for it, a new one will be generated.
	 * @param configuration - configuration of the MLS group
	 * When {@link CredentialType.X509} is chosen, it fails when no Credential has been created for the given {@link Ciphersuite}.
	 * @returns see {@link ConversationInitBundle}
	 */
	joinByExternalCommit(groupInfo: Uint8Array, credentialType: CredentialType, configuration?: CustomConfiguration): Promise<ConversationInitBundle>;
	/**
	 * This merges the commit generated by {@link CoreCrypto.joinByExternalCommit}, persists the group permanently
	 * and deletes the temporary one. This step makes the group operational and ready to encrypt/decrypt message
	 *
	 * @param conversationId - The ID of the conversation
	 * @returns eventually decrypted buffered messages if any
	 */
	mergePendingGroupFromExternalCommit(conversationId: ConversationId): Promise<BufferedDecryptedMessage[] | undefined>;
	/**
	 * In case the external commit generated by {@link CoreCrypto.joinByExternalCommit} is rejected by the Delivery Service, and we
	 * want to abort this external commit once for all, we can wipe out the pending group from the keystore in order
	 * not to waste space
	 *
	 * @param conversationId - The ID of the conversation
	 */
	clearPendingGroupFromExternalCommit(conversationId: ConversationId): Promise<void>;
	/**
	 * Allows to mark the latest commit produced as "accepted" and be able to safely merge it into the local group state
	 *
	 * @param conversationId - The group's ID
	 * @returns the messages from current epoch which had been buffered, if any
	 */
	commitAccepted(conversationId: ConversationId): Promise<BufferedDecryptedMessage[] | undefined>;
	/**
	 * Allows to remove a pending proposal (rollback). Use this when backend rejects the proposal you just sent e.g. if permissions have changed meanwhile.
	 *
	 * **CAUTION**: only use this when you had an explicit response from the Delivery Service
	 * e.g. 403 or 409. Do not use otherwise e.g. 5xx responses, timeout etc…
	 *
	 * @param conversationId - The group's ID
	 * @param proposalRef - A reference to the proposal to delete. You get one when using {@link CoreCrypto.newProposal}
	 */
	clearPendingProposal(conversationId: ConversationId, proposalRef: ProposalRef): Promise<void>;
	/**
	 * Allows to remove a pending commit (rollback). Use this when backend rejects the commit you just sent e.g. if permissions have changed meanwhile.
	 *
	 * **CAUTION**: only use this when you had an explicit response from the Delivery Service
	 * e.g. 403. Do not use otherwise e.g. 5xx responses, timeout etc..
	 * **DO NOT** use when Delivery Service responds 409, pending state will be renewed
	 * in {@link CoreCrypto.decryptMessage}
	 *
	 * @param conversationId - The group's ID
	 */
	clearPendingCommit(conversationId: ConversationId): Promise<void>;
	/**
	 * Derives a new key from the group
	 *
	 * @param conversationId - The group's ID
	 * @param keyLength - the length of the key to be derived. If the value is higher than the
	 * bounds of `u16` or the context hash * 255, an error will be returned
	 *
	 * @returns A `Uint8Array` representing the derived key
	 */
	exportSecretKey(conversationId: ConversationId, keyLength: number): Promise<Uint8Array>;
	/**
	 * Returns the raw public key of the single external sender present in this group.
	 * This should be used to initialize a subconversation
	 *
	 * @param conversationId - The group's ID
	 *
	 * @returns A `Uint8Array` representing the external sender raw public key
	 */
	getExternalSender(conversationId: ConversationId): Promise<Uint8Array>;
	/**
	 * Returns all clients from group's members
	 *
	 * @param conversationId - The group's ID
	 *
	 * @returns A list of clients from the members of the group
	 */
	getClientIds(conversationId: ConversationId): Promise<ClientId[]>;
	/**
	 * Allows {@link CoreCrypto} to act as a CSPRNG provider
	 * @note The underlying CSPRNG algorithm is ChaCha20 and takes in account the external seed provider either at init time or provided with {@link CoreCrypto.reseedRng}
	 *
	 * @param length - The number of bytes to be returned in the `Uint8Array`
	 *
	 * @returns A `Uint8Array` buffer that contains `length` cryptographically-secure random bytes
	 */
	randomBytes(length: number): Promise<Uint8Array>;
	/**
	 * Allows to reseed {@link CoreCrypto}'s internal CSPRNG with a new seed.
	 *
	 * @param seed - **exactly 32** bytes buffer seed
	 */
	reseedRng(seed: Uint8Array): Promise<void>;
	/**
	 * Initializes the proteus client
	 */
	proteusInit(): Promise<void>;
	/**
	 * Create a Proteus session using a prekey
	 *
	 * @param sessionId - ID of the Proteus session
	 * @param prekey - CBOR-encoded Proteus prekey of the other client
	 */
	proteusSessionFromPrekey(sessionId: string, prekey: Uint8Array): Promise<void>;
	/**
	 * Create a Proteus session from a handshake message
	 *
	 * @param sessionId - ID of the Proteus session
	 * @param envelope - CBOR-encoded Proteus message
	 *
	 * @returns A `Uint8Array` containing the message that was sent along with the session handshake
	 */
	proteusSessionFromMessage(sessionId: string, envelope: Uint8Array): Promise<Uint8Array>;
	/**
	 * Locally persists a session to the keystore
	 *
	 * **Note**: This isn't usually needed as persisting sessions happens automatically when decrypting/encrypting messages and initializing Sessions
	 *
	 * @param sessionId - ID of the Proteus session
	 */
	proteusSessionSave(sessionId: string): Promise<void>;
	/**
	 * Deletes a session
	 * Note: this also deletes the persisted data within the keystore
	 *
	 * @param sessionId - ID of the Proteus session
	 */
	proteusSessionDelete(sessionId: string): Promise<void>;
	/**
	 * Checks if a session exists
	 *
	 * @param sessionId - ID of the Proteus session
	 *
	 * @returns whether the session exists or not
	 */
	proteusSessionExists(sessionId: string): Promise<boolean>;
	/**
	 * Decrypt an incoming message for an existing Proteus session
	 *
	 * @param sessionId - ID of the Proteus session
	 * @param ciphertext - CBOR encoded, encrypted proteus message
	 * @returns The decrypted payload contained within the message
	 */
	proteusDecrypt(sessionId: string, ciphertext: Uint8Array): Promise<Uint8Array>;
	/**
	 * Encrypt a message for a given Proteus session
	 *
	 * @param sessionId - ID of the Proteus session
	 * @param plaintext - payload to encrypt
	 * @returns The CBOR-serialized encrypted message
	 */
	proteusEncrypt(sessionId: string, plaintext: Uint8Array): Promise<Uint8Array>;
	/**
	 * Batch encryption for proteus messages
	 * This is used to minimize FFI roundtrips when used in the context of a multi-client session (i.e. conversation)
	 *
	 * @param sessions - List of Proteus session IDs to encrypt the message for
	 * @param plaintext - payload to encrypt
	 * @returns A map indexed by each session ID and the corresponding CBOR-serialized encrypted message for this session
	 */
	proteusEncryptBatched(sessions: string[], plaintext: Uint8Array): Promise<Map<string, Uint8Array>>;
	/**
	 * Creates a new prekey with the requested ID.
	 *
	 * @param prekeyId - ID of the PreKey to generate. This cannot be bigger than a u16
	 * @returns: A CBOR-serialized version of the PreKeyBundle corresponding to the newly generated and stored PreKey
	 */
	proteusNewPrekey(prekeyId: number): Promise<Uint8Array>;
	/**
	 * Creates a new prekey with an automatically generated ID..
	 *
	 * @returns A CBOR-serialized version of the PreKeyBundle corresponding to the newly generated and stored PreKey accompanied by its ID
	 */
	proteusNewPrekeyAuto(): Promise<ProteusAutoPrekeyBundle>;
	/**
	 * Proteus last resort prekey stuff
	 *
	 * @returns A CBOR-serialize version of the PreKeyBundle associated with the last resort PreKey (holding the last resort prekey id)
	 */
	proteusLastResortPrekey(): Promise<Uint8Array>;
	/**
	 * @returns The last resort PreKey id
	 */
	static proteusLastResortPrekeyId(): number;
	/**
	 * Proteus public key fingerprint
	 * It's basically the public key encoded as an hex string
	 *
	 * @returns Hex-encoded public key string
	 */
	proteusFingerprint(): Promise<string>;
	/**
	 * Proteus session local fingerprint
	 *
	 * @param sessionId - ID of the Proteus session
	 * @returns Hex-encoded public key string
	 */
	proteusFingerprintLocal(sessionId: string): Promise<string>;
	/**
	 * Proteus session remote fingerprint
	 *
	 * @param sessionId - ID of the Proteus session
	 * @returns Hex-encoded public key string
	 */
	proteusFingerprintRemote(sessionId: string): Promise<string>;
	/**
	 * Hex-encoded fingerprint of the given prekey
	 *
	 * @param prekey - the prekey bundle to get the fingerprint from
	 * @returns Hex-encoded public key string
	 **/
	static proteusFingerprintPrekeybundle(prekey: Uint8Array): string;
	/**
	 * Imports all the data stored by Cryptobox into the CoreCrypto keystore
	 *
	 * @param storeName - The name of the IndexedDB store where the data is stored
	 */
	proteusCryptoboxMigrate(storeName: string): Promise<void>;
	/**
	 * Note: this call clears out the code and resets it to 0 (aka no error)
	 * @returns the last proteus error code that occured.
	 */
	proteusLastErrorCode(): Promise<number>;
	/**
	 * Creates an enrollment instance with private key material you can use in order to fetch
	 * a new x509 certificate from the acme server.
	 *
	 * @param clientId - client identifier e.g. `b7ac11a4-8f01-4527-af88-1c30885a7931:6add501bacd1d90e@example.com`
	 * @param displayName - human-readable name displayed in the application e.g. `Smith, Alice M (QA)`
	 * @param handle - user handle e.g. `alice.smith.qa@example.com`
	 * @param expirySec - generated x509 certificate expiry
	 * @param ciphersuite - for generating signing key material
	 * @param team - name of the Wire team a user belongs to
	 * @returns The new {@link E2eiEnrollment} enrollment instance to use with {@link CoreCrypto.e2eiMlsInitOnly}
	 */
	e2eiNewEnrollment(clientId: string, displayName: string, handle: string, expirySec: number, ciphersuite: Ciphersuite, team?: string): Promise<E2eiEnrollment>;
	/**
	 * Generates an E2EI enrollment instance for a "regular" client (with a Basic credential) willing to migrate to E2EI.
	 * Once the enrollment is finished, use the instance in {@link CoreCrypto.e2eiRotateAll} to do the rotation.
	 *
	 * @param displayName - human-readable name displayed in the application e.g. `Smith, Alice M (QA)`
	 * @param handle - user handle e.g. `alice.smith.qa@example.com`
	 * @param expirySec - generated x509 certificate expiry
	 * @param ciphersuite - for generating signing key material
	 * @param team - name of the Wire team a user belongs to
	 * @returns The new {@link E2eiEnrollment} enrollment instance to use with {@link CoreCrypto.e2eiRotateAll}
	 */
	e2eiNewActivationEnrollment(displayName: string, handle: string, expirySec: number, ciphersuite: Ciphersuite, team?: string): Promise<E2eiEnrollment>;
	/**
	 * Generates an E2EI enrollment instance for a E2EI client (with a X509 certificate credential)
	 * having to change/rotate their credential, either because the former one is expired or it
	 * has been revoked. It lets you change the DisplayName or the handle
	 * if you need to. Once the enrollment is finished, use the instance in {@link CoreCrypto.e2eiRotateAll} to do the rotation.
	 *
	 * @param expirySec - generated x509 certificate expiry
	 * @param ciphersuite - for generating signing key material
	 * @param displayName - human-readable name displayed in the application e.g. `Smith, Alice M (QA)`
	 * @param handle - user handle e.g. `alice.smith.qa@example.com`
	 * @param team - name of the Wire team a user belongs to
	 * @returns The new {@link E2eiEnrollment} enrollment instance to use with {@link CoreCrypto.e2eiRotateAll}
	 */
	e2eiNewRotateEnrollment(expirySec: number, ciphersuite: Ciphersuite, displayName?: string, handle?: string, team?: string): Promise<E2eiEnrollment>;
	/**
	 * Use this method to initialize end-to-end identity when a client signs up and the grace period is already expired ;
	 * that means he cannot initialize with a Basic credential
	 *
	 * @param enrollment - the enrollment instance used to fetch the certificates
	 * @param certificateChain - the raw response from ACME server
	 * @param nbKeyPackage - number of initial KeyPackage to create when initializing the client
	 * @returns a MlsClient initialized with only a x509 credential
	 */
	e2eiMlsInitOnly(enrollment: E2eiEnrollment, certificateChain: string, nbKeyPackage?: number): Promise<string[] | undefined>;
	/**
	 * Dumps the PKI environment as PEM
	 *
	 * @returns a struct with different fields representing the PKI environment as PEM strings
	 */
	e2eiDumpPKIEnv(): Promise<E2eiDumpedPkiEnv | undefined>;
	/**
	 * @returns whether the E2EI PKI environment is setup (i.e. Root CA, Intermediates, CRLs)
	 */
	e2eiIsPKIEnvSetup(): Promise<boolean>;
	/**
	 * Registers a Root Trust Anchor CA for the use in E2EI processing.
	 *
	 * Please note that without a Root Trust Anchor, all validations *will* fail;
	 * So this is the first step to perform after initializing your E2EI client
	 *
	 * @param trustAnchorPEM - PEM certificate to anchor as a Trust Root
	 */
	e2eiRegisterAcmeCA(trustAnchorPEM: string): Promise<void>;
	/**
	 * Registers an Intermediate CA for the use in E2EI processing.
	 *
	 * Please note that a Root Trust Anchor CA is needed to validate Intermediate CAs;
	 * You **need** to have a Root CA registered before calling this
	 *
	 * @param certPEM - PEM certificate to register as an Intermediate CA
	 */
	e2eiRegisterIntermediateCA(certPEM: string): Promise<string[] | undefined>;
	/**
	 * Registers a CRL for the use in E2EI processing.
	 *
	 * Please note that a Root Trust Anchor CA is needed to validate CRLs;
	 * You **need** to have a Root CA registered before calling this
	 *
	 * @param crlDP - CRL Distribution Point; Basically the URL you fetched it from
	 * @param crlDER - DER representation of the CRL
	 *
	 * @returns a {@link CRLRegistration} with the dirty state of the new CRL (see struct) and its expiration timestamp
	 */
	e2eiRegisterCRL(crlDP: string, crlDER: Uint8Array): Promise<CRLRegistration>;
	/**
	 * Creates a commit in all local conversations for changing the credential. Requires first
	 * having enrolled a new X509 certificate with either {@link CoreCrypto.e2eiNewActivationEnrollment}
	 * or {@link CoreCrypto.e2eiNewRotateEnrollment}
	 *
	 * @param enrollment - the enrollment instance used to fetch the certificates
	 * @param certificateChain - the raw response from ACME server
	 * @param newKeyPackageCount - number of KeyPackages with new identity to generate
	 * @returns a {@link RotateBundle} with commits to fan-out to other group members, KeyPackages to upload and old ones to delete
	 */
	e2eiRotateAll(enrollment: E2eiEnrollment, certificateChain: string, newKeyPackageCount: number): Promise<RotateBundle>;
	/**
	 * Allows persisting an active enrollment (for example while redirecting the user during OAuth) in order to resume
	 * it later with {@link e2eiEnrollmentStashPop}
	 *
	 * @param enrollment the enrollment instance to persist
	 * @returns a handle to fetch the enrollment later with {@link e2eiEnrollmentStashPop}
	 */
	e2eiEnrollmentStash(enrollment: E2eiEnrollment): Promise<Uint8Array>;
	/**
	 * Fetches the persisted enrollment and deletes it from the keystore
	 *
	 * @param handle returned by {@link e2eiEnrollmentStash}
	 * @returns the persisted enrollment instance
	 */
	e2eiEnrollmentStashPop(handle: Uint8Array): Promise<E2eiEnrollment>;
	/**
	 * Indicates when to mark a conversation as not verified i.e. when not all its members have a X509.
	 * Credential generated by Wire's end-to-end identity enrollment
	 *
	 * @param conversationId The group's ID
	 * @returns the conversation state given current members
	 */
	e2eiConversationState(conversationId: ConversationId): Promise<E2eiConversationState>;
	/**
	 * Returns true when end-to-end-identity is enabled for the given Ciphersuite
	 *
	 * @param ciphersuite of the credential to check
	 * @returns true if end-to-end identity is enabled for the given ciphersuite
	 */
	e2eiIsEnabled(ciphersuite: Ciphersuite): Promise<boolean>;
	/**
	 * From a given conversation, get the identity of the members supplied. Identity is only present for members with a
	 * Certificate Credential (after turning on end-to-end identity).
	 *
	 * @param conversationId - identifier of the conversation
	 * @param deviceIds - identifiers of the devices
	 * @returns identities or if no member has a x509 certificate, it will return an empty List
	 */
	getDeviceIdentities(conversationId: ConversationId, deviceIds: ClientId[]): Promise<WireIdentity[]>;
	/**
	 * From a given conversation, get the identity of the users (device holders) supplied.
	 * Identity is only present for devices with a Certificate Credential (after turning on end-to-end identity).
	 * If no member has a x509 certificate, it will return an empty Vec.
	 *
	 * @param conversationId - identifier of the conversation
	 * @param userIds - user identifiers hyphenated UUIDv4 e.g. 'bd4c7053-1c5a-4020-9559-cd7bf7961954'
	 * @returns a Map with all the identities for a given users. Consumers are then recommended to reduce those identities to determine the actual status of a user.
	 */
	getUserIdentities(conversationId: ConversationId, userIds: string[]): Promise<Map<string, WireIdentity[]>>;
	/**
	 * Gets the e2ei conversation state from a `GroupInfo`. Useful to check if the group has e2ei
	 * turned on or not before joining it.
	 *
	 * @param groupInfo - a TLS encoded GroupInfo fetched from the Delivery Service
	 * @param credentialType - kind of Credential to check usage of. Defaults to X509 for now as no other value will give any result.
	 * @returns see {@link E2eiConversationState}
	 */
	getCredentialInUse(groupInfo: Uint8Array, credentialType?: CredentialType): Promise<E2eiConversationState>;
	/**
	 * Returns the current version of {@link CoreCrypto}
	 *
	 * @returns The `core-crypto-ffi` version as defined in its `Cargo.toml` file
	 */
	static version(): string;
}
type JsonRawData = Uint8Array;
export declare class E2eiEnrollment {
	#private;
	/** @hidden */
	constructor(e2ei: unknown);
	free(): void;
	/**
	 * Should only be used internally
	 */
	inner(): unknown;
	/**
	 * Parses the response from `GET /acme/{provisioner-name}/directory`.
	 * Use this {@link AcmeDirectory} in the next step to fetch the first nonce from the acme server. Use
	 * {@link AcmeDirectory.newNonce}.
	 *
	 * @param directory HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.1.1
	 */
	directoryResponse(directory: JsonRawData): Promise<AcmeDirectory>;
	/**
	 * For creating a new acme account. This returns a signed JWS-alike request body to send to
	 * `POST /acme/{provisioner-name}/new-account`.
	 *
	 * @param previousNonce you got from calling `HEAD {@link AcmeDirectory.newNonce}`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.3
	 */
	newAccountRequest(previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/new-account`.
	 * @param account HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.3
	 */
	newAccountResponse(account: JsonRawData): Promise<void>;
	/**
	 * Creates a new acme order for the handle (userId + display name) and the clientId.
	 *
	 * @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/new-account`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	newOrderRequest(previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/new-order`.
	 *
	 * @param order HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	newOrderResponse(order: JsonRawData): Promise<NewAcmeOrder>;
	/**
	 * Creates a new authorization request.
	 *
	 * @param url one of the URL in new order's authorizations (use {@link NewAcmeOrder.authorizations} from {@link newOrderResponse})
	 * @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/new-order` (or from the
	 * previous to this method if you are creating the second authorization)
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5
	 */
	newAuthzRequest(url: string, previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/authz/{authz-id}`
	 *
	 * @param authz HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5
	 */
	newAuthzResponse(authz: JsonRawData): Promise<NewAcmeAuthz>;
	/**
	 * Generates a new client Dpop JWT token. It demonstrates proof of possession of the nonces
	 * (from wire-server & acme server) and will be verified by the acme server when verifying the
	 * challenge (in order to deliver a certificate).
	 *
	 * Then send it to `POST /clients/{id}/access-token`
	 * {@link https://staging-nginz-https.zinfra.io/api/swagger-ui/#/default/post_clients__cid__access_token} on wire-server.
	 *
	 * @param expirySecs of the client Dpop JWT. This should be equal to the grace period set in Team Management
	 * @param backendNonce you get by calling `GET /clients/token/nonce` on wire-server as defined here {@link https://staging-nginz-https.zinfra.io/api/swagger-ui/#/default/get_clients__client__nonce}
	 */
	createDpopToken(expirySecs: number, backendNonce: string): Promise<Uint8Array>;
	/**
	 * Creates a new challenge request for Wire Dpop challenge.
	 *
	 * @param accessToken returned by wire-server from https://staging-nginz-https.zinfra.io/api/swagger-ui/#/default/post_clients__cid__access_token
	 * @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/authz/{authz-id}`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
	 */
	newDpopChallengeRequest(accessToken: string, previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/challenge/{challenge-id}` for the DPoP challenge.
	 *
	 * @param challenge HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
	 */
	newDpopChallengeResponse(challenge: JsonRawData): Promise<void>;
	/**
	 * Creates a new challenge request for Wire Oidc challenge.
	 *
	 * @param idToken you get back from Identity Provider
	 * @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/authz/{authz-id}`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
	 */
	newOidcChallengeRequest(idToken: string, previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/challenge/{challenge-id}` for the OIDC challenge.
	 *
	 * @param cc the CoreCrypto instance
	 * @param challenge HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
	 */
	newOidcChallengeResponse(challenge: JsonRawData): Promise<void>;
	/**
	 * Verifies that the previous challenge has been completed.
	 *
	 * @param orderUrl `location` header from http response you got from {@link newOrderResponse}
	 * @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/challenge/{challenge-id}`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	checkOrderRequest(orderUrl: string, previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/order/{order-id}`.
	 *
	 * @param order HTTP response body
	 * @return finalize url to use with {@link finalizeRequest}
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	checkOrderResponse(order: JsonRawData): Promise<string>;
	/**
	 * Final step before fetching the certificate.
	 *
	 * @param previousNonce - `replay-nonce` response header from `POST /acme/{provisioner-name}/order/{order-id}`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	finalizeRequest(previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/order/{order-id}/finalize`.
	 *
	 * @param finalize HTTP response body
	 * @return the certificate url to use with {@link certificateRequest}
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	finalizeResponse(finalize: JsonRawData): Promise<string>;
	/**
	 * Creates a request for finally fetching the x509 certificate.
	 *
	 * @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/order/{order-id}/finalize`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4.2
	 */
	certificateRequest(previousNonce: string): Promise<JsonRawData>;
}
/**
 * Indicates the state of a Conversation regarding end-to-end identity.
 * Note: this does not check pending state (pending commit, pending proposals) so it does not
 * consider members about to be added/removed
 */
export declare enum E2eiConversationState {
	/**
	 * All clients have a valid E2EI certificate
	 */
	Verified = 1,
	/**
	 * Some clients are either still Basic or their certificate is expired
	 */
	NotVerified = 2,
	/**
	 * All clients are still Basic. If all client have expired certificates, NotVerified is returned.
	 */
	NotEnabled = 3
}

export {};
