import { type TypedArray } from '../tdf/index.js';
import { AuthProvider } from '../auth/providers.js';
/**
 * A Client encapsulates sessions interacting with TDF3 and nanoTDF backends, KAS and any
 * plugin-based sessions like identity and further attribute control. Most importantly, it is responsible
 * for local key and token management, including the ephemeral public/private keypairs
 * used for encrypting and decrypting information.
 *
 * @link https://developer.mozilla.org/en-US/docs/Web/API/CryptoKeyPair
 *
 * @example
 * import { Client, clientAuthProvider, decrypt, encrypt } from '@opentdf/client/nanotdf`
 *
 * const OIDC_ENDPOINT = 'http://localhost:65432/auth/';
 * const KAS_URL = 'http://localhost:65432/kas';
 *
 * let client = new Client(
 *    await clientAuthProvider({
 *      clientId: 'tdf-client',
 *      clientSecret: '123-456',
 *      oidcOrigin: OIDC_ENDPOINT,
 *    }),
 *    KAS_URL
 *  );
 *
 * // t=1
 * let nanoTDFEncrypted = await encrypt('some string', client.unwrappedKey);
 * let nanoTDFDecrypted = await decrypt(nanoTDFEncrypted, client.unwrappedKey);
 * nanoTDFDecrypted.toString() // 'some string'
 *
 */
export default class Client {
    static readonly KEY_ACCESS_REMOTE = "remote";
    static readonly KAS_PROTOCOL = "kas";
    static readonly SDK_INITIAL_RELEASE = "0.0.0";
    static readonly INITIAL_RELEASE_IV_SIZE = 3;
    static readonly IV_SIZE = 12;
    allowedKases: string[];
    protected kasUrl: string;
    protected kasPubKey: string;
    readonly authProvider: AuthProvider;
    readonly dpopEnabled: boolean;
    dissems: string[];
    dataAttributes: string[];
    protected ephemeralKeyPair?: Required<Readonly<CryptoKeyPair>>;
    protected requestSignerKeyPair?: Required<Readonly<CryptoKeyPair>>;
    protected iv?: number;
    /**
     * Create new NanoTDF Client
     *
     * The Ephemeral Key Pair can either be provided or will be generate when fetching the entity object. Once set it
     * cannot be changed. If a new ephemeral key is desired it a new client should be initialized.
     * There is no performance impact for creating a new client IFF the ephemeral key pair is provided.
     */
    constructor(authProvider: AuthProvider, kasUrl: string, ephemeralKeyPair?: Required<Readonly<CryptoKeyPair>>, dpopEnabled?: boolean);
    /**
     * Get ephemeral key pair
     *
     * Returns the ephemeral key pair to be used in other clients or undefined if not set or generated
     *
     * @security allow returning ephemeral key pair has unknown security risks.
     */
    getEphemeralKeyPair(): CryptoKeyPair | undefined;
    generateEphemeralKeyPair(): Promise<Required<Readonly<CryptoKeyPair>>>;
    generateSignerKeyPair(): Promise<Required<Readonly<CryptoKeyPair>>>;
    /**
     * Add attribute to the TDF file/data
     *
     * @param attribute The attribute that decides the access control of the TDF.
     */
    addAttribute(attribute: string): void;
    /**
     * Explicitly get a new Entity Object using the supplied EntityAttributeService.
     *
     * This method is expected to be called at least once per encrypt/decrypt cycle. If the entityObject is expired then
     * this will need to be called again.
     *
     * @security the ephemeralKeyPair must be set in the constructor if desired to use here. If this is wished to be changed
     * then a new client should be initialized.
     * @performance key pair is generated when the entity object is fetched IFF the ephemeralKeyPair is not set. This will
     * either be set on the first call or passed in the constructor.
     */
    fetchOIDCToken(): Promise<void>;
    /**
     * Rewrap key
     *
     * @important the `fetchEntityObject` method must be called prior to
     * @param nanoTdfHeader the full header for the nanotdf
     * @param kasRewrapUrl key access server's rewrap endpoint
     * @param magicNumberVersion nanotdf container version
     * @param clientVersion version of the client, as SemVer
     * @param authTagLength number of bytes to keep in the authTag
     */
    rewrapKey(nanoTdfHeader: TypedArray | ArrayBuffer, kasRewrapUrl: string, magicNumberVersion: TypedArray | ArrayBuffer, clientVersion: string, authTagLength: number): Promise<CryptoKey>;
}
//# sourceMappingURL=Client.d.ts.map