/**
 * @bunkor/crypto — SecureFormsClient
 *
 * Repository-pattern client for all Secure Form CRUD, submission management,
 * encryption-config, and public form submission operations.
 *
 * Design patterns:
 *   - Repository: clean domain interface over the Bunkor Secure Forms API
 *   - Template Method: auth + transport from BaseClient
 *
 * Usage:
 * ```ts
 * const forms = new SecureFormsClient({ apiUrl: 'https://lockbox-app-…', apiToken: 'sk_…' });
 * const list  = await forms.listForms();
 * ```
 *
 * Licensed under the Apache License, Version 2.0
 */
import { BunkorConfig } from '../config';
import { BaseClient } from './base.client';
import { CreateSecureFormRequest, SecureFormCreateResponse, SecureFormDetail, SecureFormSummary, UpdateSecureFormRequest, SecureFormLogoResponse, SecureFormEmbedSnippet, SecureFormSubmissionsResponse, SecureFormSubmissionDetail, UpdateSubmissionStatusRequest, BulkUpdateStatusRequest, BulkUpdateStatusResponse, EncryptionConfig, ZKSetupPayload, ReencryptPayload, DecryptionKeyResponse, KdfParams, PublicFormSchema, OtpSendResponse, OtpVerifyResponse, EncryptedSubmission, EncryptedSubmissionSigned, SubmitResponse, InitiateSignedUploadRequest, InitiateSignedUploadResponse, ConfirmSignedUploadRequest, ConfirmSignedUploadResponse } from '../models/secure-forms.models';
import type { StrictKdfParams } from '../models/secure-package.models';
export declare class SecureFormsClient extends BaseClient {
    private readonly base;
    constructor(config: BunkorConfig);
    /** List all secure forms. Pass `includeInactive = true` to include deactivated forms. */
    listForms(includeInactive?: boolean): Promise<SecureFormSummary[]>;
    /** Create a new secure form. */
    createForm(request: CreateSecureFormRequest): Promise<SecureFormCreateResponse>;
    /** Get full details (including sections) for a form. */
    getForm(formId: string): Promise<SecureFormDetail>;
    /** Update a form's title, sections, or notification settings. */
    updateForm(formId: string, request: UpdateSecureFormRequest): Promise<SecureFormDetail>;
    /** Deactivate (soft-delete) a form. */
    deactivateForm(formId: string): Promise<void>;
    /** Upload or replace the custom logo for a form. */
    uploadLogo(formId: string, logo: Blob, filename?: string): Promise<SecureFormLogoResponse>;
    /** Get the HTML/iframe embed snippet for a form. */
    getEmbedSnippet(formId: string): Promise<SecureFormEmbedSnippet>;
    /** List submissions for a form with optional status filter and pagination. */
    listSubmissions(formId: string, options?: {
        status?: 'new' | 'reviewed' | 'archived';
        page?: number;
        pageSize?: number;
    }): Promise<SecureFormSubmissionsResponse>;
    /** Get the full decryptable detail of a single submission. */
    getSubmission(formId: string, submissionId: string): Promise<SecureFormSubmissionDetail>;
    /** Update the review status of a single submission. */
    updateSubmissionStatus(formId: string, submissionId: string, request: UpdateSubmissionStatusRequest): Promise<SecureFormSubmissionDetail>;
    /** Bulk-update the review status of multiple submissions. */
    bulkUpdateSubmissionStatus(formId: string, request: BulkUpdateStatusRequest): Promise<BulkUpdateStatusResponse>;
    /** Permanently delete a submission. */
    deleteSubmission(formId: string, submissionId: string): Promise<void>;
    /** Get the organisation's current encryption mode and public key. */
    getEncryptionConfig(): Promise<EncryptionConfig>;
    /** Switch to server-managed encryption mode. */
    setupServerManaged(): Promise<EncryptionConfig>;
    /** Switch to zero-knowledge mode (caller must supply keypair). */
    setupZeroKnowledge(payload: ZKSetupPayload): Promise<EncryptionConfig>;
    /** Re-encrypt the private key blob after a password change. */
    reencryptPrivateKey(payload: ReencryptPayload): Promise<EncryptionConfig>;
    /** Fetch the server-managed private key PEM (server-managed mode only). */
    getPrivateKeyPem(): Promise<DecryptionKeyResponse>;
    /** Fetch the SM private key PEM for recovery export (org owner only). */
    getSmRecoveryKeyPem(): Promise<{
        private_key_pem: string;
    }>;
    /** Persist all ZK recovery blobs in one call after initial setup. */
    saveRecoveryBlobs(payload: {
        recovery_key_blob?: string;
        recovery_key_kdf_params?: StrictKdfParams;
        totp_recovery_blob?: string;
        totp_recovery_kdf_params?: StrictKdfParams;
        recovery_code_entries?: Array<{
            hash: string;
            blob: string;
            kdf_params: StrictKdfParams;
            used: boolean;
        }>;
    }): Promise<EncryptionConfig>;
    /** Clear all recovery blobs (e.g. before regenerating them). */
    clearRecoveryBlobs(): Promise<void>;
    /** Fetch a recovery code blob by its SHA-256 hash. */
    getRecoveryCodeBlob(hash: string): Promise<{
        blob: string;
        kdf_params: KdfParams;
    }>;
    /** Get the public form schema (shown to submitters, no auth required). */
    getPublicForm(pageId: string): Promise<PublicFormSchema>;
    /** Send OTP to the submitter's email for identity verification. */
    sendOtp(pageId: string, email: string): Promise<OtpSendResponse>;
    /** Verify OTP and receive a session token for the submission. */
    verifyOtp(pageId: string, email: string, otp: string): Promise<OtpVerifyResponse>;
    /**
     * Submit a form with inline encrypted files (legacy path A — small files).
     * The `files` field carries base64 encrypted blobs directly.
     */
    submitForm(pageId: string, submission: EncryptedSubmission): Promise<SubmitResponse>;
    /**
     * Submit a form with signed-URL uploaded files (path B — large files).
     * Files must already be uploaded via `initiateSignedUpload` + GCS/S3 PUT + `confirmSignedUpload`.
     */
    submitFormSigned(pageId: string, submission: EncryptedSubmissionSigned): Promise<SubmitResponse>;
    /** Initiate a signed URL upload for a form file attachment. */
    initiateSignedUpload(pageId: string, request: InitiateSignedUploadRequest): Promise<InitiateSignedUploadResponse>;
    /** Confirm a successful signed-URL upload and register the file. */
    confirmSignedUpload(pageId: string, request: ConfirmSignedUploadRequest): Promise<ConfirmSignedUploadResponse>;
}
//# sourceMappingURL=secure-forms.client.d.ts.map