/**
 * SPIFFE Workload API - gRPC Client
 * Mirrors Python WorkloadAPIClient
 *
 * Client library for workloads to fetch SVIDs from the gRPC Workload API.
 * Supports streaming X.509-SVIDs with automatic rotation.
 */
export declare class WorkloadAPIClient {
    private socketPath;
    private logger;
    spiffeId: string | null;
    certificate: string | null;
    privateKey: string | null;
    trustBundle: string | null;
    private client;
    private streamCall;
    private running;
    constructor(options?: {
        socketPath?: string;
        logger?: {
            info: Function;
            error: Function;
            debug: Function;
        };
    });
    /** Connect to the Workload API */
    connect(): Promise<void>;
    /** Disconnect from Workload API */
    disconnect(): Promise<void>;
    /** Build gRPC metadata from environment variables */
    private buildMetadata;
    /**
     * Fetch X.509-SVID once (single request/response).
     * @returns true if successful, false otherwise
     */
    fetchX509SvidOnce(): Promise<boolean>;
    /**
     * Start streaming X.509-SVID updates.
     * @param onUpdate Optional callback called when SVID is updated
     */
    startStreaming(onUpdate?: (client: WorkloadAPIClient) => Promise<void>): Promise<void>;
    /**
     * Fetch JWT-SVID.
     * @param audience List of audiences for the JWT
     * @param spiffeId Optional SPIFFE ID (defaults to workload's identity)
     * @returns JWT token or null
     */
    fetchJwtSvid(audience: string[], spiffeId?: string): Promise<string | null>;
    /**
     * Validate JWT-SVID.
     * @param token JWT token to validate
     * @param audience Expected audience
     * @returns Validation result with spiffe_id and claims, or null if invalid
     */
    validateJwtSvid(token: string, audience: string): Promise<{
        spiffeId: string;
        claims: Record<string, string>;
    } | null>;
    /**
     * Get mTLS configuration for HTTP clients.
     * @returns Object with cert, key, and caBundle, or null if not available
     */
    getMtlsConfig(): {
        cert: string;
        key: string;
        caBundle: string;
    } | null;
    /** Check if SVID is available */
    hasSvid(): boolean;
}
//# sourceMappingURL=workload-api-client.d.ts.map