import type { IEDVConfig, IEDVDocument, IHMAC, IKeyAgreementKey, IKeyResolver, IRecipientTemplate, ISigner, IZcap } from '@interop/data-integrity-core';
import { EdvClientCore } from './EdvClientCore.js';
import type { EqualsFilter, HasFilter } from './EdvClientCore.js';
import { HttpsTransport, type HttpsAgent } from './HttpsTransport.js';
/**
 * Options shared by every method that authorizes an EDV operation with a zcap
 * invocation.
 */
export interface IZcapAuthOptions {
    capability?: IZcap | string;
    invocationSigner?: ISigner;
}
/**
 * Options for `insert` / `update`.
 */
export interface IClientWriteOptions extends IZcapAuthOptions {
    doc?: IEDVDocument;
    stream?: ReadableStream;
    chunkSize?: number;
    recipients?: IRecipientTemplate[];
    keyResolver?: IKeyResolver;
    keyAgreementKey?: IKeyAgreementKey;
    hmac?: IHMAC;
    additionalProtectedParams?: Record<string, unknown>;
    chunkedAad?: boolean;
}
/**
 * Options for `updateIndex`.
 */
export interface IClientUpdateIndexOptions extends IZcapAuthOptions {
    doc?: IEDVDocument;
    hmac?: IHMAC;
}
/**
 * Options for `delete`.
 */
export interface IClientDeleteOptions extends IZcapAuthOptions {
    doc?: IEDVDocument;
    recipients?: IRecipientTemplate[];
    keyResolver?: IKeyResolver;
    keyAgreementKey?: IKeyAgreementKey;
}
/**
 * Options for `get`.
 */
export interface IClientGetOptions extends IZcapAuthOptions {
    id?: string;
    keyAgreementKey?: IKeyAgreementKey;
}
/**
 * Options for `getStream`.
 */
export interface IClientGetStreamOptions extends IZcapAuthOptions {
    doc?: IEDVDocument;
    keyAgreementKey?: IKeyAgreementKey;
}
/**
 * Options for `count` and the attribute-matching portion of `find`.
 */
export interface IClientCountOptions extends IZcapAuthOptions {
    keyAgreementKey?: IKeyAgreementKey;
    hmac?: IHMAC;
    equals?: EqualsFilter;
    has?: HasFilter;
}
/**
 * Options for `find`.
 */
export interface IClientFindOptions extends IClientCountOptions {
    returnDocuments?: boolean;
    count?: boolean;
    limit?: number;
}
/**
 * Options for `getConfig`.
 */
export interface IClientGetConfigOptions extends IZcapAuthOptions {
    id?: string;
    headers?: Record<string, string>;
}
/**
 * Options for `updateConfig`.
 */
export interface IClientUpdateConfigOptions extends IZcapAuthOptions {
    config?: IEDVConfig;
    headers?: Record<string, string>;
}
/**
 * Options for `revokeCapability`.
 */
export interface IRevokeCapabilityOptions extends IZcapAuthOptions {
    capabilityToRevoke?: IZcap;
}
/**
 * Options for the static `createEdv`.
 */
export interface ICreateEdvOptions extends IZcapAuthOptions {
    url?: string;
    config?: IEDVConfig;
    httpsAgent?: HttpsAgent;
    headers?: Record<string, string>;
}
/**
 * Options for the static `findConfig` / `findConfigs`.
 */
export interface IFindConfigsOptions extends IZcapAuthOptions {
    url?: string;
    controller?: string;
    referenceId?: string;
    after?: string;
    limit?: number;
    httpsAgent?: HttpsAgent;
    headers?: Record<string, string>;
}
/**
 * Note: An Encrypted Data Vault (EDV) server MUST expose an HTTPS API with a
 * URL structure that is partitioned like so:
 *
 * <edvID>/documents/<documentID> .
 *
 * The <edvID> must take the form:
 *
 * <authority>/edvs/<multibase base58 multihash encoded random ID> .
 */
export declare class EdvClient extends EdvClientCore {
    capability?: IZcap | string;
    invocationSigner?: ISigner;
    httpsAgent?: HttpsAgent;
    defaultHeaders: Record<string, string>;
    /**
     * Creates a new EdvClient for connecting to an Encrypted Data Vault (EDV).
     *
     * @param {object} options - The options to use.
     * @param {object} [options.capability] - An authorization capability
     *   (zcap) to use that will work with every method called on the client
     *   with the exception of `revokeCapability`, where a capability must be
     *   passed to that function if the root zcap is not to be invoked.
     * @param {object} [options.defaultHeaders] - Default HTTP headers to use
     *   with HTTPS requests.
     * @param {HttpsAgent} [options.httpsAgent] - A HttpsAgent to use to handle
     *   HTTPS requests.
     * @param {object} [options.hmac] - A default HMAC API for blinding
     *   indexable attributes.
     * @param {object} [options.invocationSigner] - An object with an
     *   `id` property and a `sign` function for signing capability invocations.
     * @param {string} [options.id] - The ID of the EDV that must be a
     *   URL that refers to the EDV's root storage location; if not given, then
     *   a separate capability must be given here that can be used for each
     *   method to be called -- or a separate capability must be given to each
     *   called method directly.
     * @param {object} [options.keyAgreementKey] - A default KeyAgreementKey
     *   API for deriving shared KEKs for wrapping content encryption keys.
     * @param {Function} [options.keyResolver] - A default function that returns
     *   a Promise that resolves a key ID to a DH public key.
     * @param {string} [options.cipherVersion='recommended'] - Sets the cipher
     *   version to either "recommended" or "fips".
     * @param {string} [options._attributeVersion] - Sets the blinded attribute
     *   version to use; for internal use only.
     *
     * @returns {EdvClient} An EdvClient instance.
     */
    constructor({ capability, defaultHeaders, hmac, id, invocationSigner, httpsAgent, keyAgreementKey, keyResolver, cipherVersion, _attributeVersion }?: {
        capability?: IZcap | string;
        defaultHeaders?: Record<string, string>;
        hmac?: IHMAC;
        id?: string;
        invocationSigner?: ISigner;
        httpsAgent?: HttpsAgent;
        keyAgreementKey?: IKeyAgreementKey;
        keyResolver?: IKeyResolver;
        cipherVersion?: 'recommended' | 'fips';
        _attributeVersion?: number;
    });
    /**
     * Builds an `HttpsTransport` from this client's connection settings (EDV ID,
     * agent, default headers), for the given per-call `capability`,
     * `invocationSigner`, and optional extra `headers`. The given values are
     * passed through as-is so callers control whether they default to the
     * client's own `capability` / `invocationSigner`.
     *
     * @param {object} options - The options to use.
     * @param {object|string} [options.capability] - The authorization capability
     *   (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner] - An API for signing a
     *   capability invocation.
     * @param {object} [options.headers] - Extra headers to merge over the
     *   client's default headers for this request.
     *
     * @returns {HttpsTransport} The transport instance.
     */
    _createTransport({ capability, invocationSigner, headers }?: {
        capability?: IZcap | string;
        invocationSigner?: ISigner;
        headers?: Record<string, string>;
    }): HttpsTransport;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {object} options.doc - The document to insert.
     * @param {ReadableStream} [options.stream] - A WHATWG Readable stream to read
     *   from to associate chunked data with this document.
     * @param {number} [options.chunkSize=1048576] - The size, in bytes, of the
     *   chunks to break the incoming stream data into.
     * @param {object[]} [options.recipients=[]] - A set of JWE recipients
     *   to encrypt the document for; if not present, a default recipient will
     *   be added using `this.keyAgreementKey` and if no `keyAgreementKey` is
     *   set, an error will be thrown.
     * @param {Function} [options.keyResolver=this.keyResolver] - A function that
     *   returns a Promise that resolves a key ID to a DH public key.
     * @param {object} [options.keyAgreementKey=this.keyAgreementKey] - A
     *   KeyAgreementKey API for deriving shared KEKs for wrapping content
     *   encryption keys.
     * @param {object} [options.hmac=this.hmac] - An HMAC API for blinding
     *   indexable attributes.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise<object>} - Resolves to the inserted document.
     */
    insert({ doc, stream, chunkSize, recipients, keyResolver, keyAgreementKey, hmac, additionalProtectedParams, chunkedAad, capability, invocationSigner }?: IClientWriteOptions): Promise<any>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {object} options.doc - The document to insert.
     * @param {ReadableStream} [options.stream] - A WHATWG Readable stream to read
     *   from to associate chunked data with this document.
     * @param {number} [options.chunkSize=1048576] - The size, in bytes, of the
     *   chunks to break the incoming stream data into.
     * @param {object} [options.recipients=[]] - A set of JWE recipients to
     *   encrypt the document for; if present, recipients will be added to any
     *   existing recipients; to remove existing recipients, modify the
     *   `encryptedDoc.jwe.recipients` field.
     * @param {Function} [options.keyResolver=this.keyResolver] - A function that
     *   returns a Promise that resolves a key ID to a DH public key.
     * @param {object} [options.keyAgreementKey=this.keyAgreementKey] - A
     *   KeyAgreementKey API for deriving shared KEKs for wrapping content
     *   encryption keys.
     * @param {object} [options.hmac=this.hmac] - An HMAC API for blinding
     *   indexable attributes.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise<object>} - Resolves to the updated document.
     */
    update({ doc, stream, chunkSize, recipients, keyResolver, keyAgreementKey, hmac, additionalProtectedParams, chunkedAad, capability, invocationSigner }?: IClientWriteOptions): Promise<any>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {object} options.doc - The document to create or update an index
     *   for.
     * @param {object} [options.hmac=this.hmac] - An HMAC API for blinding
     *   indexable attributes.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise} - Resolves once the operation completes.
     */
    updateIndex({ doc, hmac, capability, invocationSigner }?: IClientUpdateIndexOptions): Promise<void>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {object} options.doc - The document to delete.
     * @param {object} [options.recipients=[]] - A set of JWE recipients to
     *   encrypt the document for; if present, recipients will be added to
     *   any existing recipients; to remove existing recipients, modify
     *   the `encryptedDoc.jwe.recipients` field.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     * @param {Function} [options.keyResolver=this.keyResolver] - A function that
     *   returns a Promise that resolves a key ID to a DH public key.
     * @param {object} [options.keyAgreementKey=this.keyAgreementKey] - A
     *   KeyAgreementKey API for deriving shared KEKs for wrapping content
     *   encryption keys.
     *
     * @returns {Promise<boolean>} - Resolves to `true` if the document was
     *   deleted.
     */
    delete({ doc, recipients, capability, invocationSigner, keyResolver, keyAgreementKey }?: IClientDeleteOptions): Promise<boolean>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {string} options.id - The ID of the document to get.
     * @param {object} [options.keyAgreementKey=this.keyAgreementKey] - A
     *   KeyAgreementKey API for deriving a shared KEK to unwrap the content
     *   encryption key.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise<object>} - Resolves to the document.
     */
    get({ id, keyAgreementKey, capability, invocationSigner }?: IClientGetOptions): Promise<IEDVDocument>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {object} options.doc - The document to get a stream for.
     * @param {object} [options.keyAgreementKey=this.keyAgreementKey] - A
     *   KeyAgreementKey API for deriving a shared KEK to unwrap the content
     *   encryption key.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise<ReadableStream>} - Resolves to a `ReadableStream` to read
     *   the chunked data from.
     */
    getStream({ doc, keyAgreementKey, capability, invocationSigner }?: IClientGetStreamOptions): Promise<ReadableStream<any>>;
    /**
     * @inheritdoc
     *
     * @see find - For more detailed documentation on the search options.
     *
     * @param {object} options - The options to use.
     * @param {object} [options.keyAgreementKey=this.keyAgreementKey] - A
     *   KeyAgreementKey API for deriving a shared KEK to unwrap the content
     *   encryption key.
     * @param {object} [options.hmac=this.hmac] - An HMAC API for blinding
     *   indexable attributes.
     * @param {object|Array} [options.equals] - An object with key-value
     *   attribute pairs to match or an array of such objects.
     * @param {string|Array} [options.has] - A string with an attribute name to
     *   match or an array of such strings.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise<number>} - Resolves to the number of matching documents.
     */
    count({ keyAgreementKey, hmac, equals, has, capability, invocationSigner }?: IClientCountOptions): Promise<any>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {object} [options.keyAgreementKey=this.keyAgreementKey] - A
     *   KeyAgreementKey API for deriving a shared KEK to unwrap the content
     *   encryption key.
     * @param {object} [options.hmac=this.hmac] - An HMAC API for blinding
     *   indexable attributes.
     * @param {object|Array} [options.equals] - An object with key-value
     *   attribute pairs to match or an array of such objects.
     * @param {string|Array} [options.has] - A string with an attribute name to
     *   match or an array of such strings.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     * @param {boolean} [options.returnDocuments] - Set to `false` to
     *   request only document IDs from the server (not full documents); note
     *   that a server that does not accept this option will return full
     *   documents, so either return value is possible.
     * @param {boolean} [options.count] - Set to `false` to find all documents
     *   that match a query or to `true` to give a count of documents.
     * @param {number} [options.limit] - Set to limit the number of documents
     *   to be returned from a query (min=1, max=1000).
     *
     * @returns {Promise<object>} - Resolves to the matching documents:
     *   {documents: [...]} OR to the matching document IDs, if requested
     *   and supported by the server: {documentIds: [...]}.
     */
    find({ keyAgreementKey, hmac, equals, has, capability, invocationSigner, returnDocuments, count, limit }?: IClientFindOptions): Promise<any>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {string} [options.id] - The ID of the EDV config; defaults to the
     *   client's configured EDV ID.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.headers] - An optional
     *   headers object to use when making requests.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise<object>} - Resolves to the configuration for the EDV.
     */
    getConfig({ id, capability, headers, invocationSigner }?: IClientGetConfigOptions): Promise<any>;
    /**
     * @inheritdoc
     *
     * @param {object} options - The options to use.
     * @param {object} options.config - The new EDV config.
     * @param {object|string} [options.capability=this.capability] - The
     *   authorization capability (zcap) to use to authorize the operation.
     * @param {object} [options.headers] - An optional headers object to use when
     *   making requests.
     * @param {object} [options.invocationSigner=this.invocationSigner] - An API
     *   with an `id` property and a `sign` function for signing a capability
     *   invocation.
     *
     * @returns {Promise<void>} - Resolves once the operation completes.
     */
    updateConfig({ config, capability, headers, invocationSigner }?: IClientUpdateConfigOptions): Promise<any>;
    /**
     * Revoke an authorization capability (zcap). If no `capability` is passed,
     * then the root zcap for the revocation endpoint will be invoked.
     *
     * @param {object} options - The options to use.
     * @param {object} options.capabilityToRevoke - The capability to revoke.
     * @param {object|string} [options.capability] - The authorization capability
     *   (zcap) to use to authorize the operation.
     * @param {object} options.invocationSigner - An API with an
     *   `id` property and a `sign` function for signing a capability invocation.
     *
     * @returns {Promise<object>} Resolves once the operation completes.
     */
    revokeCapability({ capabilityToRevoke, capability, invocationSigner }?: IRevokeCapabilityOptions): Promise<void>;
    /**
     * Parses an EDV ID from a capability's invocation target.
     *
     * @param {object} options - The options to use.
     * @param {object|string} options.capability - The authorization capability
     *   (zcap) to parse the EDV ID from.
     *
     * @returns {string} - The ID of the EDV.
     */
    parseEdvId({ capability }?: {
        capability?: IZcap | string;
    }): string;
    /**
     * Creates a new EDV using the given configuration.
     *
     * @param {object} options - The options to use.
     * @param {string} options.url - The url to post the configuration to.
     * @param {string} options.config - The EDV's configuration.
     * @param {object|string} [options.capability] - The authorization capability
     *   (zcap) to use to authorize the operation.
     * @param {object} [options.headers=undefined] - An optional
     *   headers object to use when making requests.
     * @param {HttpsAgent} [options.httpsAgent=undefined] - An optional
     *   node.js `https.Agent` instance to use when making requests.
     * @param {object} [options.invocationSigner] - An object with an
     *   `id` property and a `sign` function for signing a capability invocation.
     *
     * @returns {Promise<object>} - Resolves to the configuration for the newly
     *   created EDV.
     */
    static createEdv({ url, config, capability, httpsAgent, headers, invocationSigner }?: ICreateEdvOptions): Promise<unknown>;
    /**
     * Gets the EDV config for the given controller and reference ID.
     *
     * @param {object} options - The options to use.
     * @param {string} options.url - The url to query.
     * @param {string} options.controller - The ID of the controller.
     * @param {string} options.referenceId - A controller-unique reference ID.
     * @param {HttpsAgent} [options.httpsAgent] - An optional
     *   node.js `https.Agent` instance to use when making requests.
     * @param {object} [options.headers] - An optional
     *   headers object to use when making requests.
     * @param {object} [options.invocationSigner] - An object with an
     *   `id` property and a `sign` function for signing a capability invocation.
     * @param {object|string} [options.capability] - The authorization capability
     *   (zcap) to use to authorize the operation.
     *
     * @returns {Promise<object>} - Resolves to the EDV configuration
     *   containing the given controller and reference ID.
     */
    static findConfig({ url, controller, referenceId, httpsAgent, invocationSigner, headers, capability }?: IFindConfigsOptions): Promise<any>;
    /**
     * Get all EDV configurations matching a query.
     *
     * @param {object} options - The options to use.
     * @param {string} options.url - The url to query.
     * @param {string} options.controller - The EDV's controller.
     * @param {string} [options.referenceId] - A controller-unique reference ID.
     * @param {string} [options.after] - An EDV's ID.
     * @param {number} [options.limit] - How many EDV configs to return.
     * @param {HttpsAgent} [options.httpsAgent=undefined] - An optional
     *   node.js `https.Agent` instance to use when making requests.
     * @param {object} [options.headers=undefined] - An optional
     *   headers object to use when making requests.
     * @param {object} [options.invocationSigner] - An object with an
     *   `id` property and a `sign` function for signing a capability invocation.
     * @param {object|string} [options.capability] - The authorization capability
     *   (zcap) to use to authorize the operation.
     *
     * @returns {Promise<Array>} - Resolves to the matching EDV configurations.
     */
    static findConfigs({ url, controller, referenceId, after, limit, httpsAgent, headers, capability, invocationSigner }?: IFindConfigsOptions): Promise<unknown>;
    /**
     * Generates a multibase encoded random 128-bit identifier for a document.
     *
     * @returns {Promise<string>} - Resolves to the identifier.
     */
    static generateId(): Promise<string>;
    /**
     * Migrates all documents that match the given `equals` or `has` query
     * from the attribute version configured for the `from` EdvClient instance
     * to the attribute version configured for the `to` EdvClient instance.
     *
     * This method should be used with caution. It is not exposed as a public
     * API (it is marked private by `_` convention).
     *
     * WARNING: Concurrent writes to an EDV store should be prevented while it is
     * running if the operating environment cannot guarantee that uniqueness
     * constraints will not be violated.
     *
     * WARNING: At present, this method will fail if the number of documents to
     * be migrated exceeds a maximum of `999`.
     *
     * A more robust implementation may be provided in the future if further
     * migrations are needed.
     *
     * @param {object} options - The options to use.
     * @param {EdvClient} options.from - The EDV client instance configured to
     *   use the attribute version to convert from.
     * @param {EdvClient} options.to - The EDV client instance configured to
     *   use the attribute version to convert to.
     * @param {object|Array} [options.equals] - An object with key-value
     *   attribute pairs to match or an array of such objects.
     * @param {string|Array} [options.has] - A string with an attribute name to
     *   match or an array of such strings.
     *
     * @returns {Promise} Resolves once the operation completes.
     */
    static _migrate({ from, to, equals, has }?: {
        from?: EdvClient;
        to?: EdvClient;
        equals?: EqualsFilter;
        has?: HasFilter;
    }): Promise<void>;
    _getDocUrl(id: any, capability: any): any;
    /**
     * Parses an EDV ID from a capability's invocation target.
     *
     * @param {object} options - The options to use.
     * @param {object|string} options.capability - The authorization capability
     *   (zcap) to parse the EDV ID from.
     *
     * @returns {string} - The ID of the EDV.
     */
    static _parseEdvId({ capability }?: {
        capability?: IZcap | string;
    }): string;
    static _getInvocationTarget({ capability }: {
        capability?: IZcap | string;
    }): string | null;
}
/**
 * A node.js HTTPS agent.
 *
 * @typedef {object} HttpsAgent
 * @see https://nodejs.org/api/https.html#https_class_https_agent
 */
//# sourceMappingURL=EdvClient.d.ts.map