import type { CachedToken, TokenStore } from './token-store/types.js';
import type { AdpTransport } from './transport/types.js';
import { EventNotifications } from './event-notifications.js';
import { Worker } from './worker.js';
export interface ClientOptions {
    /** Enables lazy auto-authentication. */
    credentials?: {
        client_id: string;
        client_secret: string;
    };
    tokenStore?: TokenStore;
    transport?: AdpTransport;
    apiBaseUrl?: string;
    tokenUrl?: string;
    /** Default true. Pass false to receive unmasked government IDs. */
    masked?: boolean;
    /** Client-side envelope validation against event metas. Default true. */
    validateEvents?: boolean;
    /** Meta cache TTL in ms. Default 12 h. Exposed primarily as a test hook. */
    metaCacheTtlMs?: number;
}
/** Accepts raw PEM or base64-encoded PEM (the `.env` convention). */
export declare function normalizePem(input: string): string;
export declare class Client {
    readonly worker: Worker;
    readonly eventNotifications: EventNotifications;
    private readonly transport;
    private readonly tokenStore;
    private readonly credentials?;
    private readonly apiBaseUrl;
    private readonly tokenUrl;
    private readonly masked;
    readonly validateEvents: boolean;
    readonly metaCacheTtlMs: number;
    constructor(certificate: string, privateKey: string, options?: ClientOptions);
    authenticate(): Promise<CachedToken>;
    private getToken;
    private send;
    /**
     * Escape hatch: same auth/mTLS/401-retry/error semantics as request(),
     * but exposes response status and headers (some ADP endpoints carry data
     * in headers — e.g. the event-notification delete handle). 204 resolves
     * with body undefined but real status/headers.
     */
    raw(method: string, path: string, data?: unknown): Promise<{
        status: number;
        headers: Headers;
        body: unknown;
    }>;
    /**
     * @internal Binary-capable request core (worker photo methods). Same lazy
     * auth, single 401 retry, and typed-error semantics as raw(); differs in
     * caller-controlled Content-Type and optional bytes-response. Not part of
     * the public API contract.
     */
    binaryRequest(args: {
        method: string;
        path: string;
        body?: Uint8Array;
        contentType?: string;
        bytesResponse?: boolean;
    }): Promise<{
        status: number;
        headers: Headers;
        body: unknown;
        bytes?: Uint8Array;
    }>;
    request(method: string, path: string, data?: unknown): Promise<unknown>;
    get(path: string): Promise<unknown>;
    post(path: string, data: unknown): Promise<unknown>;
}