/// <reference types="node" resolution-mode="require"/>
import { GenerateDataKeyPairCommandOutput, KMS, KMSClientConfig } from '@aws-sdk/client-kms';
import { SignOptions } from '@collabland/common';
export type KMSServiceOptions = KMSClientConfig & {
    keyId?: string;
};
/**
 * KMS encrypted authentication token that extends JWT
 */
export type AEToken<T extends object = object> = T & {
    iat: number;
    exp: number;
    aud: string;
    iss: string;
    sub: string;
};
export declare function getCMK(): string;
export declare class KMSServiceClient {
    readonly keyId: string;
    readonly kms: KMS;
    constructor(options?: KMSServiceOptions);
    encrypt(data: Uint8Array | string, ctx?: Record<string, string>): Promise<Buffer>;
    encryptJson(data: object, ctx?: Record<string, string>): Promise<Uint8Array>;
    decrypt(data: Uint8Array, ctx?: Record<string, string>): Promise<Buffer>;
    decryptJson<T extends object = object>(data: Uint8Array, ctx?: Record<string, string>): Promise<T>;
    generateDataKeyPair(ctx?: Record<string, string>, keyPairSpec?: "ECC_SECG_P256K1"): Promise<GenerateDataKeyPairCommandOutput>;
    /**
     * Export KMS key pair to PEM format
     * @param keyPair - KMS key pair
     * @returns
     */
    exportPEMKeys(keyPair: GenerateDataKeyPairCommandOutput): {
        privateKey: string | Buffer;
        publicKey: string | Buffer;
    };
    /**
     * Generate key pair in PEM format
     * @param ctx
     * @param keyPairSpec
     * @returns
     */
    generatePEMKeyPair(ctx?: Record<string, string>, keyPairSpec?: "ECC_SECG_P256K1"): Promise<{
        privateKey: string | Buffer;
        publicKey: string | Buffer;
    }>;
    /**
     * Generate Mac-then-Encrypt authenticated encryption token (base64 encoded)
     * {@link https://en.wikipedia.org/wiki/Authenticated_encryption#MAC-then-Encrypt_(MtE) | MAC-then-Encrypt_(MtE)}
     *
     * 1. Load a jwt secret
     * 2. Encode/sign the data into a JWT
     * 3. Encrypt the JWT using KMS
     * 4. Encode the result in base 64 as the AE token
     *
     * @param data - JSON object
     * @param subject - JWT subject
     * @param expiresIn - JWT expiration
     */
    generateAEToken<T extends object = object>(data: T, subject?: string, expiresIn?: number | string): Promise<string>;
    generateAEToken<T extends object = object>(data: T, options?: SignOptions): Promise<string>;
    /**
     * Verify if the authenticated encryption (AE) token
     * {@link https://en.wikipedia.org/wiki/Authenticated_encryption#MAC-then-Encrypt_(MtE) | MAC-then-Encrypt_(MtE)}
     *
     * 1. Decode the token using base 64
     * 2. Decrypt the result using KMS
     * 3. Verify the JWT token
     *
     * @param token - Mac-then-Encrypt AE Token (base64 encoded)
     */
    verifyAEToken<T extends object = object>(token: string): Promise<AEToken<T>>;
    generateJwtSecret(key?: string): Promise<string>;
}
export declare function toUint8Array(str?: string): Uint8Array;
export declare function fromUint8Array(data?: Uint8Array): string;