/**
 * Proxy download executor for fetching binary content through API
 *
 * Why: LLM needs file content but URLs require authentication.
 * This executor fetches metadata, extracts URL, downloads content,
 * and returns base64-encoded result.
 */
import type { ProxyDownloadOperation } from '../types/profile.js';
import type { ResponseContext, AuthCredentials } from '../transport/interceptors.js';
export interface DebugLogger {
    debug(message: string, context?: Record<string, unknown>): void;
    warn?(message: string, context?: Record<string, unknown>): void;
}
export interface HttpClient {
    request(method: string, url: string, options?: {
        headers?: Record<string, string>;
        body?: unknown;
    }): Promise<ResponseContext>;
    getBaseUrl(): string;
}
export interface ProxyDownloadResult {
    /** Original metadata from API */
    metadata: Record<string, unknown>;
    /** Base64-encoded file content */
    content: string;
    /** MIME type of the file */
    mimeType: string;
    /** File size in bytes */
    size: number;
    /** Original filename if available */
    fileName?: string;
}
export declare class ProxyDownloadExecutor {
    private httpClient;
    private logger;
    private ssrfValidator;
    constructor(httpClient: HttpClient, logger?: DebugLogger);
    /**
     * Execute proxy download operation
     *
     * @param operation Proxy download configuration
     * @param path API path with substituted parameters
     * @param authCredentials Auth credentials (headers + query params) for download
     */
    execute(operation: ProxyDownloadOperation, metadataRequest: {
        path: string;
        method: string;
    }, authCredentials: AuthCredentials, directDownloadRequest?: {
        path: string;
        method: string;
    }): Promise<ProxyDownloadResult>;
    private resolveMaxSize;
    /**
     * Extract URL from metadata using dot-notation path
     */
    private extractUrl;
    private extractNestedString;
    private extractNestedNumber;
    private extractNestedValue;
    private getBaseOrigin;
    private resolveHttpUrl;
    private enforceDownloadPolicy;
    private resolveDownloadTargetPolicy;
    /**
     * Check if MIME type matches whitelist (supports wildcards like 'image/*')
     */
    private isMimeTypeAllowed;
    /**
     * Download binary content and return base64
     *
     * @param skipAuth If true, download URL is fetched without authentication headers/params
     *                 Metadata endpoint still requires auth, only the final download is unauthenticated
     */
    private downloadWithAuth;
    private buildDownloadUrlWithOptionalQueryAuth;
    private isRedirectStatus;
    private resolveRedirectTarget;
    private enforceAllowedDownloadTarget;
    /**
     * Handle inline data URLs (data:mime;base64,...)
     */
    private downloadFromDataUrl;
}
//# sourceMappingURL=proxy-executor.d.ts.map