import { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models';
import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
import { EncryptedEntityWithType, EncryptedFieldsManifest, EntityWithDelegationTypeName } from '../utils';
import { CryptoPrimitives } from './CryptoPrimitives';
import { SecurityMetadataDecryptor } from './SecurityMetadataDecryptor';
import { SecureDelegation } from '../../icc-api/model/SecureDelegation';
import { ExtendedApisUtils } from './ExtendedApisUtils';
import { EntityBulkShareResult } from '../../icc-api/model/requests/EntityBulkShareResult';
import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest';
import { SecureDelegationsManager } from './SecureDelegationsManager';
import { ShareResult } from '../utils/ShareResult';
import { ShareMetadataBehaviour } from './ShareMetadataBehaviour';
import { IccUserXApi } from '../icc-user-x-api';
import { MinimalEntityBulkShareResult } from '../../icc-api/model/requests/MinimalEntityBulkShareResult';
import { BulkShareOrUpdateMetadataParams } from '../../icc-api/model/requests/BulkShareOrUpdateMetadataParams';
import RequestedPermissionEnum = EntityShareRequest.RequestedPermissionEnum;
import { SecretIdUseOption } from './SecretIdUseOption';
/**
 * @internal this class is for internal use only and may be changed without notice.
 * Methods to support extended apis.
 */
export declare class ExtendedApisUtilsImpl implements ExtendedApisUtils {
    private readonly primitives;
    private readonly dataOwnerApi;
    private readonly securityMetadataDecryptor;
    private readonly secureDelegationsManager;
    private readonly userApi;
    private readonly useParentKeys;
    constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, securityMetadataDecryptor: SecurityMetadataDecryptor, secureDelegationsManager: SecureDelegationsManager, userApi: IccUserXApi, useParentKeys: boolean);
    encryptionKeysOf(entity: EncryptedEntityWithType, dataOwnerId?: string): Promise<string[]>;
    encryptionKeysForHcpHierarchyOf(entity: EncryptedEntityWithType): Promise<{
        ownerId: string;
        extracted: string[];
    }[]>;
    secretIdsOf(entity: EncryptedEntityWithType, dataOwnerId?: string): Promise<string[]>;
    secretIdsForHcpHierarchyOf(entity: EncryptedEntityWithType): Promise<{
        ownerId: string;
        extracted: string[];
    }[]>;
    owningEntityIdsOf(entity: EncryptedEntityWithType, dataOwnerId?: string): Promise<string[]>;
    owningEntityIdsForHcpHierarchyOf(entity: EncryptedEntityWithType): Promise<{
        ownerId: string;
        extracted: string[];
    }[]>;
    hasWriteAccess(entity: EncryptedEntityWithType): Promise<boolean>;
    entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(entity: T, entityType: EntityWithDelegationTypeName, owningEntity: string | undefined, owningEntitySecretIds: string[] | undefined, initialiseEncryptionKey: boolean, autoDelegations: {
        [p: string]: SecureDelegation.AccessLevelEnum;
    }, alternateRootDelegation: string | undefined): Promise<{
        updatedEntity: T;
        rawEncryptionKey: string | undefined;
        secretId: string;
    }>;
    bulkShareOrUpdateEncryptedEntityMetadata<T extends EncryptedEntityStub>(entitiesType: EntityWithDelegationTypeName, entitiesUpdates: {
        entity: EncryptedEntityStub;
        dataForDelegates: {
            [delegateId: string]: {
                shareSecretIds?: string[];
                shareEncryptionKeys?: string[];
                shareOwningEntityIds?: string[];
                requestedPermissions: RequestedPermissionEnum;
            };
        };
    }[], doRequestBulkShareOrUpdate: (request: BulkShareOrUpdateMetadataParams) => Promise<EntityBulkShareResult<T>[]>): Promise<{
        updatedEntities: T[];
        unmodifiedEntitiesIds: string[];
        updateErrors: {
            entityId: string;
            delegateId: string;
            request?: {
                shareSecretIds?: string[];
                shareEncryptionKeys?: string[];
                shareOwningEntityIds?: string[];
                requestedPermissions: RequestedPermissionEnum;
            };
            updatedForMigration: boolean;
            code?: number;
            reason?: string;
        }[];
    }>;
    bulkShareOrUpdateEncryptedEntityMetadataNoEntities(entitiesType: EntityWithDelegationTypeName, entitiesUpdates: {
        entity: EncryptedEntityStub;
        dataForDelegates: {
            [delegateId: string]: {
                shareSecretIds: string[];
                shareEncryptionKeys: string[];
                shareOwningEntityIds: string[];
                requestedPermissions: EntityShareRequest.RequestedPermissionEnum;
            };
        };
    }[], doRequestBulkShareOrUpdate: (request: BulkShareOrUpdateMetadataParams) => Promise<MinimalEntityBulkShareResult[]>): Promise<{
        unmodifiedEntitiesIds: string[];
        successfulUpdates: {
            entityId: string;
            delegateId: string;
        }[];
        updateErrors: {
            entityId: string;
            delegateId: string;
            request?: {
                shareSecretIds?: string[];
                shareEncryptionKeys?: string[];
                shareOwningEntityIds?: string[];
                requestedPermissions: EntityShareRequest.RequestedPermissionEnum;
            };
            updatedForMigration: boolean;
            code?: number;
            reason?: string;
        }[];
    }>;
    /**
     * Whether an existing, already-established access level (`undefined` if none) is enough to satisfy a requested
     * permission, without needing to create/update a delegation just for the permission itself. `ROOT` is a special,
     * self-only request independent of any other delegation on the entity, so it is never considered satisfied by
     * unrelated existing coverage.
     *
     * `MAX_WRITE` doesn't demand write access outright: it resolves to WRITE only if the caller granting it
     * (`callerAccess`) itself has WRITE, and to READ otherwise - so an existing READ is already sufficient for a
     * `MAX_WRITE` request unless the caller could actually upgrade it to WRITE.
     */
    private isPermissionSufficient;
    private prepareBulkShareRequests;
    simpleShareOrUpdateEncryptedEntityMetadata<T extends EncryptedEntityStub>(entity: {
        entity: T;
        type: EntityWithDelegationTypeName;
    }, delegates: {
        [p: string]: {
            shareSecretIds: string[] | undefined;
            shareEncryptionKeys: ShareMetadataBehaviour | undefined;
            shareOwningEntityIds: ShareMetadataBehaviour | undefined;
            requestedPermissions: EntityShareRequest.RequestedPermissionEnum | undefined;
        };
    }, doRequestBulkShareOrUpdate: (request: BulkShareOrUpdateMetadataParams) => Promise<EntityBulkShareResult<T>[]>): Promise<ShareResult<T>>;
    private makeMigrationRequestsIfNeeded;
    private makeMigrationRequestForMemberOfHierarchy;
    tryDecryptDataOf(entity: EncryptedEntityWithType, content: ArrayBuffer | Uint8Array, postProcessor?: (decryptedData: ArrayBuffer) => Promise<ArrayBuffer | undefined>): Promise<{
        data: ArrayBuffer;
        wasDecrypted: boolean;
    }>;
    encryptDataOf<T extends EncryptedEntityStub>(entity: T, type: EntityWithDelegationTypeName, content: ArrayBuffer | Uint8Array, saveEntity: (entity: T) => Promise<T>): Promise<{
        encryptedData: ArrayBuffer;
        updatedEntity: T | undefined;
    }>;
    tryDecryptEntities<T extends EncryptedEntity>(entities: T[], entityType: EntityWithDelegationTypeName, constructor: (json: any) => T): Promise<{
        entity: T;
        decrypted: boolean;
    }[]>;
    tryDecryptJson(potentialKeys: {
        key: CryptoKey;
        raw: string;
    }[], encrypted: Uint8Array, truncateTrailingDecryptedNulls: boolean): Promise<{} | null>;
    tryEncryptEntities<T extends EncryptedEntity>(entities: T[], entityType: EntityWithDelegationTypeName, fieldsToEncrypt: EncryptedFieldsManifest, encodeBinaryData: boolean, requireEncryption: boolean, constructor: (json: any) => T): Promise<T[]>;
    ensureEncryptionKeysInitialised<T extends EncryptedEntity>(entity: T, entityType: EntityWithDelegationTypeName): Promise<T | undefined>;
    private decryptHierarchy;
    private decryptAndMergeHierarchy;
    private tryImportKey;
    doIncrementallyDecryptingKeys<E extends EncryptedEntity | EncryptedEntityStub, T>(entity: E, entityType: EntityWithDelegationTypeName, action: (entity: E, entityType: EntityWithDelegationTypeName, keys: {
        key: CryptoKey;
        raw: string;
    }[]) => Promise<{
        success: T;
    } | null>): Promise<{
        success: T;
    } | null>;
    doManyIncrementallyDecryptingKeys<E extends EncryptedEntity | EncryptedEntityStub, T>(entities: E[], entitiesType: EntityWithDelegationTypeName, action: (entity: E, entityType: EntityWithDelegationTypeName, keys: {
        key: CryptoKey;
        raw: string;
    }[]) => Promise<{
        success: T;
    } | null>): Promise<Map<string, T>>;
    private deduplicate;
    private throwDetailedExceptionForInvalidParameter;
    private checkEmptyEncryptionMetadata;
    hasEmptyEncryptionMetadata(entity: EncryptedEntity): boolean;
    private doCheckEmptyEncryptionMetadata;
    initialiseConfidentialSecretId<T extends EncryptedEntity>(entity: T, entityType: EntityWithDelegationTypeName, doRequestBulkShareOrUpdate: (request: BulkShareOrUpdateMetadataParams) => Promise<EntityBulkShareResult<T>[]>): Promise<T | undefined>;
    getConfidentialSecretId(entity: EncryptedEntityWithType, dataOwnerId?: string): Promise<string | undefined>;
    getConfidentialSecretIds(entity: EncryptedEntityWithType, dataOwnerId?: string): Promise<string[]>;
    getAnySecretIdSharedWithParents(entity: EncryptedEntityWithType): Promise<string | undefined>;
    getSecretIdsSharedWithParents(entity: EncryptedEntityWithType): Promise<string[]>;
    resolveSecretIdUseOptions(entity: EncryptedEntityWithType, option: SecretIdUseOption): Promise<string[]>;
    private deduplicateById;
}