/**
 * Validation utilities for the Orbitport SDK
 */
import type { OrbitportConfig, CTRNGRequest, ValidationResult, RequestOptions, CreateKeyRequest, EncryptRequest, DecryptRequest, SignRequest, GenerateDataKeyRequest, RotateKeyRequest, PlaintextEncoding } from '../types';
/**
 * Validates the Orbitport configuration
 */
export declare function validateConfig(config: Partial<OrbitportConfig>): ValidationResult;
/**
 * Validates cTRNG request parameters
 */
export declare function validateCTRNGRequest(request: Partial<CTRNGRequest>): ValidationResult;
/**
 * Validates request options
 */
export declare function validateRequestOptions(options: Partial<RequestOptions>): ValidationResult;
/**
 * Validates URL format
 */
export declare function isValidUrl(url: string): boolean;
/**
 * Validates JWT token format (basic validation)
 */
export declare function isValidJWT(token: string): boolean;
/**
 * Validates token expiration
 */
export declare function isTokenExpired(token: string, bufferSeconds?: number): boolean;
/**
 * Sanitizes configuration by removing undefined values and applying defaults
 */
export declare function sanitizeConfig(config: Partial<OrbitportConfig>): OrbitportConfig;
/**
 * Sanitizes request options by applying defaults and validation
 */
export declare function sanitizeRequestOptions(options?: Partial<RequestOptions>): RequestOptions;
/**
 * Validates and sanitizes cTRNG request
 */
export declare function sanitizeCTRNGRequest(request: Partial<CTRNGRequest>): CTRNGRequest;
/**
 * Validates a KMS key alias.
 *
 * Rejects spaces, length>128, and the gateway-reserved `kms:` prefix.
 */
export declare function validateKMSAlias(alias: string): void;
/**
 * Validates a CreateKey request and returns the JSON-RPC params (PascalCase).
 */
export declare function sanitizeCreateKeyRequest(req: CreateKeyRequest): Record<string, unknown>;
/**
 * Validates an Encrypt request. Returns `{ params, encoding }`.
 *
 * `params` is the wire-shape JSON-RPC params (PascalCase Plaintext is added by
 * the service after base64 encoding); the encoding is returned so the caller
 * can pick the right base64 conversion path.
 */
export declare function sanitizeEncryptRequest(req: EncryptRequest): {
    keyId: string;
    encoding: PlaintextEncoding;
    plaintext: string | Uint8Array;
    encryptionAlgorithm?: string;
};
/**
 * Validates a Decrypt request. Returns the encoding plus wire params.
 */
export declare function sanitizeDecryptRequest(req: DecryptRequest): {
    encoding: PlaintextEncoding;
    params: Record<string, unknown>;
};
/**
 * Validates a Sign request. Returns wire params plus the raw message for
 * the service to base64-encode.
 */
export declare function sanitizeSignRequest(req: SignRequest): {
    keyId: string;
    message: string | Uint8Array;
    signingAlgorithm: string;
    messageType: string;
};
/**
 * Validates a GenerateDataKey request and returns wire params.
 *
 * Enforces XOR: exactly one of `dataKeySpec` or `numberOfBytes`.
 */
export declare function sanitizeGenerateDataKeyRequest(req: GenerateDataKeyRequest): Record<string, unknown>;
/**
 * Validates a RotateKey request and returns wire params.
 */
export declare function sanitizeRotateKeyRequest(req: RotateKeyRequest): Record<string, unknown>;
//# sourceMappingURL=validation.d.ts.map