/**
 * @copyright
 * (c) 2025 netTrek GmbH & Co. KG – All rights reserved.
 *
 * This source code is part of the C2PA-HLS integration library.
 */
import { type Settings, type TrustSettings } from '@contentauth/c2pa-web';
import { type Interval } from '@flatten-js/interval-tree';
import { type C2paManifestHelper } from './C2paManifestHelper';
import { type NamedLogger } from './utils/NamedLogger';
import { type C2paEngine } from './engine/C2paEngine';
export interface C2PAConfig {
    enableTrustListVerification: boolean;
    /**
     * Use the experimental WebCrypto engine (@nettrek/c2pa-web-crypto) instead of
     * the WASM engine (@contentauth/c2pa-web). Default `false` → always WASM. When
     * `true`, the WebCrypto engine is used where `crypto.subtle` is available (with
     * per-asset WASM fallback); otherwise WASM. The WebCrypto engine is still
     * experimental, so it is strictly opt-in.
     */
    enableExperimentalWebCrypto?: boolean;
    /**
     * Override the WASM source URL. Use this when your bundler (e.g. Vite) rewrites
     * the default URL and causes an integrity mismatch.
     */
    wasmSrc?: string;
    /**
     * Custom C2PA trust settings. When provided together with `enableTrustListVerification: true`,
     * these are used directly instead of fetching the default list from the Content
     * Credentials trust store (`verify.contentauthenticity.org/trust/*`).
     */
    trust?: TrustSettings;
    /**
     * Custom CAWG identity trust settings. Merged into the SDK settings when provided.
     */
    cawgTrust?: TrustSettings;
    /**
     * Evaluate the `cawg.identity` assertion's signer against the C2PA trust list
     * as well. By default (and per c2pa-rs) the CAWG identity is checked against a
     * separate, empty trust policy, so an identity signed by an otherwise-trusted
     * C2PA signer is still reported `signingCredential.untrusted` and the asset
     * cannot reach `Trusted`. When `true` and no explicit `cawgTrust` is given, the
     * resolved C2PA trust resources are reused for the CAWG identity, so an
     * allow-listed signer that also signs the identity assertion validates as
     * `Trusted`. Opt-in: leaving it `false` keeps the standard, stricter default.
     */
    enableCawgIdentityTrustVerification?: boolean;
}
export type { TrustSettings };
export interface C2paBridge {
    getC2PAMetaByTimeCode: (timeCode: number) => C2paManifestHelper | null;
    getTamperedWithIntervals: () => Interval[];
    libReady: () => boolean;
    dispose: () => void;
}
export declare class AbstractC2PABridge implements NamedLogger, C2paBridge {
    log: (...args: any[]) => void;
    warn: (...args: any[]) => void;
    error: (...args: any[]) => void;
    protected readonly config: C2PAConfig;
    protected c2pa: C2paEngine | null;
    protected c2paTookitSettings: Settings | null;
    constructor(config?: C2PAConfig);
    /**
     * Retrieves the C2PA manifest metadata associated with a specific timecode
     * of the currently playing stream.
     *
     * @param timeCode - The playback position in seconds.
     * @returns A C2PAManifestReader instance or null if not found.
     * @abstract
     */
    getC2PAMetaByTimeCode(timeCode: number): C2paManifestHelper | null;
    /**
     * Returns a list of intervals that represent tampered (invalid) segments
     * in the current stream level.
     *
     * @returns An array of Interval objects for invalid segments.
     * @abstract
     */
    getTamperedWithIntervals(): Interval[];
    /**
     * Returns status of c2pa library (i.e. ready to use)
     */
    libReady(): boolean;
    /**
     * Unregisters the fragment listener and disposes of the C2PA runtime.
     * Should be called when the adapter is no longer needed.
     */
    dispose(): void;
    /**
     * Fetches a trust-related resource file from the Content Credentials trust store.
     *
     * Uses the canonical verifier host directly: `contentcredentials.org/trust/*`
     * 301-redirects here and serves no CORS headers (so a browser fetch is blocked
     * by the redirect), whereas `verify.contentauthenticity.org` responds 200 with
     * `Access-Control-Allow-Origin: *`.
     *
     * @param file - The name of the file to load (e.g., 'anchors.pem', 'allowed.sha256.txt').
     * @returns A promise resolving to the content of the requested file as a string.
     */
    private loadTrustResource;
    /**
     * Loads all required trust configuration resources in parallel and
     * constructs a `ToolkitSettings` object for trust verification.
     *
     * Downloads:
     * - `anchors.pem`: Trust anchor certificates
     * - `allowed.sha256.txt`: Hashes of allowed content
     * - `store.cfg`: Trust store configuration
     *
     * @returns A promise that resolves to a fully populated `ToolkitSettings` object
     *          used for C2PA signature verification.
     */
    private getToolkitSettings;
    private loadRemoteTrustSettings;
    protected onRuntimeReady(): void;
}