import type { Mandate, CreateMandateRequest, VerifyRequest, VerifyResponse, VerifyResponseWithPoM, VerifyResponseWithSemantics, VerifyOptions, AuditEvent, PaginatedResponse, EvidencePack, InstructionResponse, EudiSessionResponse, EudiSessionStatus, TenantIdpConfig, TenantIdpConfigUpdate } from "./types.js";
import { type Decision, type DecisionRedemption, type DecisionRequest } from "./decisions.js";
/**
 * Configuration for {@link MandaitorClient}. The API key and tenant ID are
 * required; base URL, timeout, and retry behaviour have production defaults.
 */
export interface MandaitorClientConfig {
    /** API key issued during tenant onboarding */
    apiKey: string;
    /** Tenant identifier, e.g. "tnt_example_prod" */
    tenantId: string;
    /** API base URL (defaults to production) */
    baseUrl?: string;
    /** Request timeout in milliseconds (default: 5000) */
    timeout?: number;
    /** Number of retries for 5xx/429 errors (default: 2) */
    retries?: number;
}
/**
 * HTTP client for the Mandaitor Delegation Mandate Registry API.
 *
 * Wraps the REST API with typed methods for the full mandate lifecycle
 * (create, verify, revoke, suspend, approve), audit-event retrieval, evidence
 * packs, EUDI Wallet sessions, identity-provider configuration, and OAuth 2.0
 * token exchange. Requests carry the tenant-scoped bearer credential and are
 * automatically retried on 5xx/429 responses with exponential backoff.
 *
 * @example
 * ```ts
 * const client = new MandaitorClient({
 *   apiKey: process.env.MANDAITOR_API_KEY!,
 *   tenantId: "tnt_example_prod",
 * });
 * const result = await client.verify({
 *   delegate_subject_id: "agent:example:validate-v2",
 *   action: "construction.validation.approve",
 *   resource: "construction:project:proj_123/plan.pdf",
 * });
 * ```
 */
export declare class MandaitorClient {
    private config;
    constructor(config: MandaitorClientConfig);
    private request;
    /** Create a new delegation mandate. Starts ACTIVE unless `require_approval` is set. */
    createMandate(req: CreateMandateRequest): Promise<Mandate>;
    /** Fetch a single mandate by its ID. */
    getMandate(mandateId: string): Promise<Mandate>;
    /** List mandates for the tenant, optionally filtered by status, with cursor pagination. */
    listMandates(params?: {
        status?: string;
        limit?: number;
        cursor?: string;
    }): Promise<PaginatedResponse<Mandate>>;
    /** Permanently revoke a mandate. Terminal state — a revoked mandate cannot be reactivated. */
    revokeMandate(mandateId: string, reason?: string): Promise<Mandate>;
    /** Temporarily suspend a mandate. Can be reactivated later via {@link reactivateMandate}. */
    suspendMandate(mandateId: string, reason?: string): Promise<Mandate>;
    /** Reactivate a previously suspended mandate, returning it to ACTIVE. */
    reactivateMandate(mandateId: string): Promise<Mandate>;
    /** Approve a mandate that is PENDING_APPROVAL, transitioning it to ACTIVE. */
    approveMandate(mandateId: string, reason?: string): Promise<Mandate>;
    /** Reject a mandate that is PENDING_APPROVAL, so it never becomes active. */
    rejectMandate(mandateId: string, reason?: string): Promise<Mandate>;
    /**
     * Verify that a delegate is authorized for an action on a resource. Returns an
     * ALLOW/DENY decision with an audit event ID. This is the core hot-path call.
     */
    verify(req: VerifyRequest): Promise<VerifyResponse>;
    /**
     * Verify an action and optionally request a Proof-of-Mandate VC.
     *
     * @example
     * ```ts
     * const result = await client.verifyWithPoM(
     *   { delegate_subject_id: "agent:v2", action: "approve", resource: "proj/*" },
     *   { pom: "sd-jwt-vc" },
     * );
     * if (result.proof_of_mandate) {
     *   console.log(result.proof_of_mandate.compact); // SD-JWT string
     * }
     * ```
     */
    verifyWithPoM(req: VerifyRequest, options: VerifyOptions): Promise<VerifyResponseWithPoM>;
    /**
     * @experimental Verify an action with drift detection signals.
     *
     * Returns advisory semantic signals alongside the verification decision.
     * Drift signals NEVER affect the ALLOW/DENY decision.
     *
     * @example
     * ```ts
     * const result = await client.verifyWithDrift(
     *   { delegate_subject_id: "agent:v2", action: "approve", resource: "proj/*" },
     *   { drift: true },
     * );
     * if (result.semantic_signals?.drift_score?.drift_detected) {
     *   console.warn("Drift detected!", result.semantic_signals.drift_score);
     * }
     * ```
     */
    verifyWithDrift(req: VerifyRequest, options: VerifyOptions): Promise<VerifyResponseWithSemantics>;
    /**
     * Ask for a decision on one operation the enforcement point is about to
     * perform for an agent, on the facts it read from its own system. An ALLOW
     * carries an authorization for exactly this request, valid five minutes;
     * DENY and REQUIRE_APPROVAL carry none, and no approval is raised.
     * Nothing may be done on an ALLOW until {@link redeemDecision} succeeds.
     */
    requestDecision(request: DecisionRequest): Promise<Decision>;
    /**
     * Redeem an ALLOW's authorization, once, immediately before acting on it.
     * The digest is computed here from `request`, the operation about to be
     * performed, never taken from the answer: Mandaitor refuses the redemption
     * unless it decided exactly this request. A 409 (`ALREADY_REDEEMED`,
     * `DIGEST_MISMATCH`, `AUTHORIZATION_EXPIRED`, `MANDATE_NOT_ACTIVE`,
     * `AGENT_NOT_ACTIVE`) means do not act, also when an earlier attempt's answer
     * was lost: ask for a new decision.
     */
    redeemDecision(decisionId: string, request: Pick<DecisionRequest, "agent" | "action" | "resource" | "facts" | "audience">): Promise<DecisionRedemption>;
    /** List the hash-chained audit events for a single mandate, with cursor pagination. */
    getMandateEvents(mandateId: string, params?: {
        limit?: number;
        cursor?: string;
    }): Promise<PaginatedResponse<AuditEvent>>;
    /** @deprecated Use {@link getMandateEvents} instead. */
    getAuditEvents(mandateId: string, options?: {
        limit?: number;
        cursor?: string;
    }): Promise<PaginatedResponse<AuditEvent>>;
    /** List audit events across the tenant, optionally filtered by mandate or event type. */
    listEvents(params?: {
        mandate_id?: string;
        limit?: number;
        cursor?: string;
        event_type?: string;
    }): Promise<PaginatedResponse<AuditEvent>>;
    /** Fetch a single audit event by ID, scoped to its mandate. */
    getEvent(eventId: string, mandateId: string): Promise<AuditEvent>;
    /**
     * Retrieve the decrypted instruction for a mandate.
     *
     * **Security note:** Calling this endpoint creates an `INSTRUCTION_REVEALED`
     * audit event. The instruction text is encrypted at rest and only decrypted
     * on demand. Use sparingly — every call is logged.
     *
     * @param mandateId - The mandate whose instruction to reveal
     * @returns The decrypted instruction with metadata
     * @throws {MandaitorNotFoundError} If the mandate has no VUI or does not exist
     *
     * @example
     * ```ts
     * const instruction = await client.getMandateInstruction("mnd_abc123");
     * console.log(instruction.instruction_text); // "Bestelle Büromaterial bis 500€"
     * console.log(instruction.instruction_channel); // "chat"
     * ```
     */
    getMandateInstruction(mandateId: string): Promise<InstructionResponse>;
    /**
     * Export a court-ready evidence pack for a mandate.
     * Contains the mandate snapshot, hash-chained event log, proof tokens,
     * case_log_hash, and issuer DID reference for independent verification.
     *
     * @param mandateId - The mandate to export evidence for
     * @param eventId - Optional: scope the pack to a specific verification event
     */
    getEvidencePack(mandateId: string, eventId?: string): Promise<EvidencePack>;
    /**
     * Initiate an EUDI Wallet verification session.
     * Returns a session with QR code and deep link URIs for the wallet flow.
     *
     * @param presentationDefinitionId - Optional: which PID attributes to request
     *   (defaults to "mandaitor-pid-standard")
     */
    initiateEudiSession(presentationDefinitionId?: string): Promise<EudiSessionResponse>;
    /**
     * Poll the status of an EUDI Wallet verification session.
     * Returns the resolved identity when the session is completed.
     */
    getEudiSessionStatus(sessionId: string): Promise<EudiSessionStatus>;
    /**
     * Get the identity provider configuration for this tenant.
     */
    getIdpConfig(): Promise<TenantIdpConfig>;
    /**
     * Update the identity provider configuration.
     */
    updateIdpConfig(config: TenantIdpConfigUpdate): Promise<TenantIdpConfig>;
}
//# sourceMappingURL=client.d.ts.map