@wireapp/core-crypto/src/corecrypto.d.ts

CoreCrypto bindings for the Web

// Generated by dts-bundle-generator v9.5.1

/* tslint:disable */
/* eslint-disable */
/**
 * Get an instance of the default ciphersuite.
 */
export function ciphersuiteDefault(): Ciphersuite;
/**
 * Construct a ciphersuite enum instance from its discriminant.
 */
export function ciphersuiteFromU16(discriminant: number): Ciphersuite;
/**
 * Open or create a [Database].
 */
export function openDatabase(name: string, key: DatabaseKey): Promise<Database>;
/**
 * Updates the key of the CoreCrypto database.
 * To be used only once, when moving from CoreCrypto <= 5.x to CoreCrypto 6.x.
 */
export function migrateDatabaseKeyTypeToBytes(path: string, old_key: string, new_key: DatabaseKey): Promise<void>;
/**
 * Updates the key of the CoreCrypto database.
 */
export function updateDatabaseKey(name: string, old_key: DatabaseKey, new_key: DatabaseKey): Promise<void>;
/**
 * MLS ciphersuites.
 */
export enum Ciphersuite {
	/**
	 * DH KEM x25519 | AES-GCM 128 | SHA2-256 | Ed25519
	 */
	MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519 = 1,
	/**
	 * DH KEM P256 | AES-GCM 128 | SHA2-256 | EcDSA P256
	 */
	MLS_128_DHKEMP256_AES128GCM_SHA256_P256 = 2,
	/**
	 * DH KEM x25519 | Chacha20Poly1305 | SHA2-256 | Ed25519
	 */
	MLS_128_DHKEMX25519_CHACHA20POLY1305_SHA256_Ed25519 = 3,
	/**
	 * DH KEM x448 | AES-GCM 256 | SHA2-512 | Ed448
	 */
	MLS_256_DHKEMX448_AES256GCM_SHA512_Ed448 = 4,
	/**
	 * DH KEM P521 | AES-GCM 256 | SHA2-512 | EcDSA P521
	 */
	MLS_256_DHKEMP521_AES256GCM_SHA512_P521 = 5,
	/**
	 * DH KEM x448 | Chacha20Poly1305 | SHA2-512 | Ed448
	 */
	MLS_256_DHKEMX448_CHACHA20POLY1305_SHA512_Ed448 = 6,
	/**
	 * DH KEM P384 | AES-GCM 256 | SHA2-384 | EcDSA P384
	 */
	MLS_256_DHKEMP384_AES256GCM_SHA384_P384 = 7
}
/**
 * Type of Credential
 */
export enum CredentialType {
	/**
	 * Basic credential i.e. a KeyPair
	 */
	Basic = 1,
	/**
	 * A x509 certificate generally obtained through e2e identity enrollment process
	 */
	X509 = 2
}
/**
 * Indicates the standalone status of a device Credential in a MLS group at a moment T.
 *
 * This does not represent the states where a device is not using MLS or is not using end-to-end identity
 */
export enum DeviceStatus {
	/**
	 * All is fine
	 */
	Valid = 1,
	/**
	 * The Credential's certificate is expired
	 */
	Expired = 2,
	/**
	 * The Credential's certificate is revoked (not implemented yet)
	 */
	Revoked = 3
}
declare enum E2eiConversationState {
	/**
	 * All clients have a valid E2EI certificate
	 */
	Verified = 1,
	/**
	 * Some clients are either still Basic or their certificate is expired
	 */
	NotVerified = 2,
	/**
	 * All clients are still Basic. If all client have expired certificates, [E2eiConversationState::NotVerified] is returned.
	 */
	NotEnabled = 3
}
declare enum MlsGroupInfoEncryptionType {
	/**
	 * Unencrypted `GroupInfo`
	 */
	Plaintext = 1,
	/**
	 * `GroupInfo` encrypted in a JWE
	 */
	JweEncrypted = 2
}
declare enum MlsRatchetTreeType {
	/**
	 * Plain old and complete `GroupInfo`
	 */
	Full = 1,
	/**
	 * Contains `GroupInfo` changes since previous epoch (not yet implemented)
	 * (see [draft](https://github.com/rohan-wire/ietf-drafts/blob/main/mahy-mls-ratchet-tree-delta/draft-mahy-mls-ratchet-tree-delta.md))
	 */
	Delta = 2,
	ByRef = 3
}
/**
 * See [core_crypto::prelude::MlsWirePolicy]
 */
export enum WirePolicy {
	/**
	 * Handshake messages are never encrypted
	 */
	Plaintext = 1,
	/**
	 * Handshake messages are always encrypted
	 */
	Ciphertext = 2
}
/**
 * For creating a challenge.
 *
 * - See <https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1>
 * - See [core_crypto::e2e_identity::types::E2eiAcmeChallenge]
 */
export class AcmeChallenge {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Contains raw JSON data of this challenge. This is parsed by the underlying Rust library hence should not be accessed
	 */
	readonly delegate: Uint8Array;
	/**
	 * URL of this challenge
	 */
	readonly url: string;
	/**
	 * Non-standard, Wire specific claim. Indicates the consumer from where it should get the challenge proof.
	 * Either from wire-server "/access-token" endpoint in case of a DPoP challenge, or from an OAuth token endpoint for an OIDC challenge
	 */
	readonly target: string;
}
declare class AcmeDirectory {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * URL for fetching a new nonce. Use this only for creating a new account.
	 */
	readonly newNonce: string;
	/**
	 * URL for creating a new account.
	 */
	readonly newAccount: string;
	/**
	 * URL for creating a new order.
	 */
	readonly newOrder: string;
	/**
	 * Revocation URL
	 */
	readonly revokeCert: string;
}
declare class BufferedDecryptedMessage {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Decrypted plaintext
	 */
	readonly message: Uint8Array | undefined;
	/**
	 * False if processing this message caused the client to be removed from the group, i.e. due to a Remove commit
	 */
	readonly isActive: boolean;
	/**
	 * Commit delay in seconds.
	 *
	 * When set, clients must delay this long before processing a commit.
	 * This reduces load on the backend, which otherwise would receive epoch change notifications from all clients simultaneously.
	 */
	readonly commitDelay: bigint | undefined;
	/**
	 * [ClientId] of the sender of the message being decrypted. Only present for application messages.
	 */
	readonly senderClientId: ClientId | undefined;
	/**
	 * true when the decrypted message resulted in an epoch change i.e. it was a commit
	 *
	 * Deprecated: this member will be removed in the future. Prefer using the `EpochObserver` interface.
	 */
	readonly hasEpochChanged: boolean;
	/**
	 * Identity claims present in the sender credential
	 */
	readonly identity: WireIdentity;
	/**
	 * New CRL distribution points that appeared by the introduction of a new credential
	 */
	readonly crlNewDistributionPoints: string[] | undefined;
}
/**
 * Metadata describing the conditions of the build of this software.
 */
export class BuildMetadata {
	private constructor();
	/**
	** Return copy of self without private attributes.
	*/
	toJSON(): Object;
	/**
	* Return stringified version of self.
	*/
	toString(): string;
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Build Timestamp
	 */
	readonly timestamp: string;
	/**
	 * Whether this build was in Debug mode (true) or Release mode (false)
	 */
	readonly cargoDebug: string;
	/**
	 * Features enabled for this build
	 */
	readonly cargoFeatures: string;
	/**
	 * Optimization level
	 */
	readonly optLevel: string;
	/**
	 * Build target triple
	 */
	readonly targetTriple: string;
	/**
	 * Git branch
	 */
	readonly gitBranch: string;
	/**
	 * Output of `git describe`
	 */
	readonly gitDescribe: string;
	/**
	 * Hash of current git commit
	 */
	readonly gitSha: string;
	/**
	 * `true` when the source code differed from the commit at the most recent git hash
	 */
	readonly gitDirty: string;
}
/**
 * A Client identifier
 *
 * A unique identifier for clients. A client is an identifier for each App a user is using, such as desktop,
 * mobile, etc. Users can have multiple clients.
 * More information [here](https://messaginglayersecurity.rocks/mls-architecture/draft-ietf-mls-architecture.html#name-group-members-and-clients)
 */
export class ClientId {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Copy the id into a new byte array.
	 */
	copyBytes(): Uint8Array;
	/**
	 * Instantiate a client id from a byte array.
	 */
	constructor(bytes: Uint8Array);
}
declare class ConversationConfiguration {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Construct a `ConversationConfiguration` from its parts.
	 */
	constructor(ciphersuite?: Ciphersuite | null, external_senders?: ExternalSenderKey[] | null, key_rotation_span?: number | null, wire_policy?: WirePolicy | null);
	/**
	 * The ciphersuite used in the group
	 */
	readonly ciphersuite: Ciphersuite | undefined;
	/**
	 * Delivery service public signature key and credential
	 */
	readonly externalSenders: ExternalSenderKey[];
	/**
	 * Implementation specific configuration
	 */
	readonly custom: CustomConfiguration;
}
/**
 * r" A unique identifier for a single conversation.
 * r"
 * r" The backend provides an opaque string identifying a new conversation.
 * r" Construct an instance of this newtype to pass that identifier to Rust.
 */
export class ConversationId {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Get the raw bytes from this type, transferring data from Rust to the client layer.
	 *
	 * This does not consume the newtype, instead copying the internal data across the FFI boundary.
	 */
	copyBytes(): Uint8Array;
	/**
	 * Construct a new instance, transferring data from the client layer to Rust.
	 */
	constructor(bytes: Uint8Array);
}
declare class CoreCryptoContext {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * See [core_crypto::prelude::Session::random_bytes].
	 */
	random_bytes(len: number): Promise<Uint8Array>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::get_data]
	 */
	get_data(): Promise<Uint8Array | undefined>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::set_data]
	 */
	set_data(data: Uint8Array): Promise<void>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::get_client_ids]
	 */
	get_client_ids(conversation_id: ConversationId): Promise<ClientId[]>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::decrypt_message]
	 */
	decrypt_message(conversation_id: ConversationId, payload: Uint8Array): Promise<DecryptedMessage>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::encrypt_message]
	 */
	encrypt_message(conversation_id: ConversationId, message: Uint8Array): Promise<Uint8Array>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::client_public_key]
	 */
	client_public_key(ciphersuite: Ciphersuite, credential_type: CredentialType): Promise<Uint8Array>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::export_secret_key]
	 */
	export_secret_key(conversation_id: ConversationId, key_length: number): Promise<SecretKey>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::wipe]
	 */
	wipe_conversation(conversation_id: ConversationId): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::get_or_create_client_keypackages]
	 */
	client_keypackages(ciphersuite: Ciphersuite, credential_type: CredentialType, amount_requested: number): Promise<KeyPackage[]>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::epoch]
	 */
	conversation_epoch(conversation_id: ConversationId): Promise<bigint>;
	/**
	 * See [core_crypto::prelude::Session::conversation_exists]
	 */
	conversation_exists(conversation_id: ConversationId): Promise<boolean>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::new_conversation]
	 */
	create_conversation(conversation_id: ConversationId, creator_credential_type: CredentialType, config: ConversationConfiguration): Promise<void>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::get_external_sender]
	 */
	get_external_sender(conversation_id: ConversationId): Promise<ExternalSenderKey>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::enable_history_sharing]
	 */
	enable_history_sharing(conversation_id: ConversationId): Promise<void>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::update_key_material]
	 */
	update_keying_material(conversation_id: ConversationId): Promise<void>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::disable_history_sharing]
	 */
	disable_history_sharing(conversation_id: ConversationId): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::join_by_external_commit]
	 */
	join_by_external_commit(group_info: GroupInfo, custom_configuration: CustomConfiguration, credential_type: CredentialType): Promise<WelcomeBundle>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::process_raw_welcome_message]
	 */
	process_welcome_message(welcome_message: Welcome, custom_configuration: CustomConfiguration): Promise<WelcomeBundle>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::commit_pending_proposals]
	 */
	commit_pending_proposals(conversation_id: ConversationId): Promise<void>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::ciphersuite]
	 */
	conversation_ciphersuite(conversation_id: ConversationId): Promise<Ciphersuite>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::add_members]
	 */
	add_clients_to_conversation(conversation_id: ConversationId, key_packages: KeyPackage[]): Promise<string[] | undefined>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::mark_as_child_of]
	 */
	mark_conversation_as_child_of(child_id: ConversationId, parent_id: ConversationId): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::client_valid_key_packages_count]
	 */
	client_valid_keypackages_count(ciphersuite: Ciphersuite, credential_type: CredentialType): Promise<bigint>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::remove_members]
	 */
	remove_clients_from_conversation(conversation_id: ConversationId, clients: ClientId[]): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::mls_init]
	 */
	mls_init(client_id: ClientId, ciphersuites: any[], nb_key_package?: number | null): Promise<void>;
	/**
	 * See [core_crypto::mls::conversation::ConversationGuard::e2ei_rotate]
	 */
	e2ei_rotate(conversation_id: ConversationId): Promise<void>;
	/**
	 * See [core_crypto::prelude::Session::e2ei_is_enabled]
	 */
	e2ei_is_enabled(ciphersuite: Ciphersuite): Promise<boolean>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_register_crl]
	 */
	e2ei_register_crl(crl_dp: string, crl_der: Uint8Array): Promise<CrlRegistration>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_mls_init_only]
	 */
	e2ei_mls_init_only(enrollment: FfiWireE2EIdentity, certificate_chain: string, nb_key_package?: number | null): Promise<string[] | undefined>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_new_enrollment]
	 */
	e2ei_new_enrollment(client_id: string, display_name: string, handle: string, team: string | null | undefined, expiry_sec: number, ciphersuite: Ciphersuite): Promise<FfiWireE2EIdentity>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::get_user_identities]
	 */
	get_user_identities(conversation_id: ConversationId, user_ids: string[]): Promise<Map<string, WireIdentity[]>>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::save_x509_credential]
	 */
	save_x509_credential(enrollment: FfiWireE2EIdentity, certificate_chain: string): Promise<string[] | undefined>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_enrollment_stash]
	 *
	 * Note that this can only succeed if the enrollment is unique and there are no other hard refs to it.
	 */
	e2ei_enrollment_stash(enrollment: FfiWireE2EIdentity): Promise<Uint8Array>;
	/**
	 * See [core_crypto::prelude::Session::e2ei_is_pki_env_setup]
	 */
	e2ei_is_pki_env_setup(): Promise<boolean>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_register_acme_ca]
	 */
	e2ei_register_acme_ca(trust_anchor_pem: string): Promise<void>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::get_device_identities]
	 */
	get_device_identities(conversation_id: ConversationId, device_ids: ClientId[]): Promise<WireIdentity[]>;
	/**
	 * See [core_crypto::mls::conversation::Conversation::e2ei_conversation_state]
	 */
	e2ei_conversation_state(conversation_id: ConversationId): Promise<E2eiConversationState>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::delete_stale_key_packages]
	 */
	delete_stale_key_packages(ciphersuite: Ciphersuite): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_enrollment_stash_pop]
	 */
	e2ei_enrollment_stash_pop(handle: Uint8Array): Promise<FfiWireE2EIdentity>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_new_rotate_enrollment]
	 */
	e2ei_new_rotate_enrollment(display_name: string | null | undefined, handle: string | null | undefined, team: string | null | undefined, expiry_sec: number, ciphersuite: Ciphersuite): Promise<FfiWireE2EIdentity>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_register_intermediate_ca_pem]
	 */
	e2ei_register_intermediate_ca(cert_pem: string): Promise<string[] | undefined>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::e2ei_new_activation_enrollment]
	 */
	e2ei_new_activation_enrollment(display_name: string, handle: string, team: string | null | undefined, expiry_sec: number, ciphersuite: Ciphersuite): Promise<FfiWireE2EIdentity>;
	/**
	 * See [core_crypto::proteus::ProteusCentral::try_new]
	 */
	proteus_init(): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_decrypt]
	 */
	proteus_decrypt(session_id: string, ciphertext: Uint8Array): Promise<Uint8Array>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_encrypt]
	 */
	proteus_encrypt(session_id: string, plaintext: Uint8Array): Promise<Uint8Array>;
	/**
	 * Creates a new Proteus prekey with the given id and returns the CBOR-serialized version of the prekey bundle
	 *
	 * Warning: The Proteus client **MUST** be initialized with `proteus_init` first or an error will be returned
	 *
	 * See [core_crypto::transaction_context::TransactionContext::proteus_new_prekey]
	 */
	proteus_new_prekey(prekey_id: number): Promise<Uint8Array>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_fingerprint]
	 */
	proteus_fingerprint(): Promise<string>;
	/**
	 * Decrypt a message whether or not the proteus session already exists, and saves the session.
	 *
	 * This is intended to replace simple usages of `proteusDecrypt`.
	 *
	 * However, when decrypting large numbers of messages in a single session, the existing methods
	 * may be more efficient.
	 */
	proteus_decrypt_safe(session_id: string, ciphertext: Uint8Array): Promise<Uint8Array>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_session_save]
	 *
	 * **Note**: This isn't usually needed as persisting sessions happens automatically when
	 * decrypting/encrypting messages and initializing Sessions
	 */
	proteus_session_save(session_id: string): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_session_delete]
	 */
	proteus_session_delete(session_id: string): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_session_exists]
	 */
	proteus_session_exists(session_id: string): Promise<boolean>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_encrypt_batched]
	 */
	proteus_encrypt_batched(sessions: string[], plaintext: Uint8Array): Promise<Map<string, Uint8Array>>;
	/**
	 * Creates a new Proteus prekey with an automatically incremented ID and returns the CBOR-serialized version of the prekey bundle
	 *
	 * Warning: The Proteus client **MUST** be initialized with `proteus_init` first or an error will be returned
	 *
	 * See [core_crypto::transaction_context::TransactionContext::proteus_new_prekey_auto]
	 */
	proteus_new_prekey_auto(): Promise<ProteusAutoPrekeyBundle>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_reload_sessions]
	 */
	proteus_reload_sessions(): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_fingerprint_local]
	 */
	proteus_fingerprint_local(session_id: string): Promise<string>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_fingerprint_remote]
	 */
	proteus_fingerprint_remote(session_id: string): Promise<string>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_last_resort_prekey]
	 */
	proteus_last_resort_prekey(): Promise<Uint8Array>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_session_from_prekey]
	 */
	proteus_session_from_prekey(session_id: string, prekey: Uint8Array): Promise<void>;
	/**
	 * See [core_crypto::transaction_context::TransactionContext::proteus_session_from_message]
	 */
	proteus_session_from_message(session_id: string, envelope: Uint8Array): Promise<Uint8Array>;
	/**
	 * See [core_crypto::proteus::ProteusCentral::last_resort_prekey_id]
	 */
	static proteus_last_resort_prekey_id(): number;
	/**
	 * See [core_crypto::proteus::ProteusCentral::fingerprint_prekeybundle]
	 */
	static proteus_fingerprint_prekeybundle(prekey: Uint8Array): string;
}
declare class CrlRegistration {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Contstruct a CRL registration from its fields
	 */
	constructor(dirty: boolean, expiration?: bigint | null);
	/**
	 * Whether this CRL modifies the old CRL (i.e. has a different revocated cert list)
	 */
	dirty: boolean;
	/**
	 * Optional expiration timestamp
	 */
	get expiration(): bigint | undefined;
	/**
	 * Optional expiration timestamp
	 */
	set expiration(value: bigint | null | undefined);
}
/**
 * see [core_crypto::prelude::MlsCustomConfiguration]
 */
export class CustomConfiguration {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Construct a `CustomConfiguration` from its parts.
	 */
	constructor(key_rotation_span?: number | null, wire_policy?: WirePolicy | null);
	/**
	 *  Duration in seconds after which we will automatically force a self-update commit
	 *  Note: This isn't currently implemented
	 */
	get keyRotationSpan(): number | undefined;
	/**
	 *  Duration in seconds after which we will automatically force a self-update commit
	 *  Note: This isn't currently implemented
	 */
	set keyRotationSpan(value: number | null | undefined);
	/**
	 * Defines if handshake messages are encrypted or not
	 * Note: encrypted handshake messages are not supported by wire-server
	 */
	get wirePolicy(): WirePolicy | undefined;
	/**
	 * Defines if handshake messages are encrypted or not
	 * Note: encrypted handshake messages are not supported by wire-server
	 */
	set wirePolicy(value: WirePolicy | null | undefined);
}
/**
 * The database acting as a core crypto keystore.
 */
export class Database {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
}
/**
 * The key used to encrypt the database.
 */
export class DatabaseKey {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Construct a new instance from a byte vector.
	 */
	constructor(buf: Uint8Array);
}
declare class DecryptedMessage {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Decrypted plaintext
	 */
	readonly message: Uint8Array | undefined;
	/**
	 * False if processing this message caused the client to be removed from the group, i.e. due to a Remove commit
	 */
	readonly isActive: boolean;
	/**
	 * Commit delay in seconds.
	 *
	 * When set, clients must delay this long before processing a commit.
	 * This reduces load on the backend, which otherwise would receive epoch change notifications from all clients simultaneously.
	 */
	readonly commitDelay: bigint | undefined;
	/**
	 * [ClientId] of the sender of the message being decrypted. Only present for application messages.
	 */
	readonly senderClientId: ClientId | undefined;
	/**
	 * true when the decrypted message resulted in an epoch change i.e. it was a commit
	 *
	 * Deprecated: this member will be removed in the future. Prefer using the `EpochObserver` interface.
	 */
	readonly hasEpochChanged: boolean;
	/**
	 * Identity claims present in the sender credential
	 */
	readonly identity: WireIdentity;
	/**
	 * Only set when the decrypted message is a commit.
	 *
	 * Contains buffered messages for next epoch which were received before the commit creating the epoch
	 * because the DS did not fan them out in order.
	 */
	readonly bufferedMessages: BufferedDecryptedMessage[] | undefined;
	/**
	 * New CRL distribution points that appeared by the introduction of a new credential
	 */
	readonly crlNewDistributionPoints: string[] | undefined;
}
/**
 * r" The raw public key of an external sender.
 * r"
 * r" This can be used to initialize a subconversation.
 */
export class ExternalSenderKey {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Get the raw bytes from this type, transferring data from Rust to the client layer.
	 *
	 * This does not consume the newtype, instead copying the internal data across the FFI boundary.
	 */
	copyBytes(): Uint8Array;
	/**
	 * Construct a new instance, transferring data from the client layer to Rust.
	 */
	constructor(bytes: Uint8Array);
}
declare class FfiWireE2EIdentity {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * See [core_crypto::prelude::E2eiEnrollment::finalize_request]
	 */
	finalize_request(previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::create_dpop_token]
	 */
	create_dpop_token(expiry_secs: number, backend_nonce: string): Promise<string>;
	/**
	 * See [core_crypto::prelude::E2eiEnrollment::finalize_response]
	 */
	finalize_response(finalize: Uint8Array): Promise<string>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_authz_request]
	 */
	new_authz_request(url: string, previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_order_request]
	 */
	new_order_request(previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::directory_response]
	 */
	directory_response(directory: Uint8Array): Promise<AcmeDirectory>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_authz_response]
	 */
	new_authz_response(authz: Uint8Array): Promise<NewAcmeAuthz>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_order_response]
	 */
	new_order_response(order: Uint8Array): Promise<NewAcmeOrder>;
	/**
	 * See [core_crypto::prelude::E2eiEnrollment::certificate_request]
	 */
	certificate_request(previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::check_order_request]
	 */
	check_order_request(order_url: string, previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_account_request]
	 */
	new_account_request(previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::check_order_response]
	 */
	check_order_response(order: Uint8Array): Promise<string>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_account_response]
	 */
	new_account_response(account: Uint8Array): Promise<void>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_dpop_challenge_request]
	 */
	new_dpop_challenge_request(access_token: string, previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_oidc_challenge_request]
	 */
	new_oidc_challenge_request(id_token: string, previous_nonce: string): Promise<Uint8Array>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_dpop_challenge_response]
	 */
	new_dpop_challenge_response(challenge: Uint8Array): Promise<void>;
	/**
	 * See [core_crypto::e2e_identity::E2eiEnrollment::new_oidc_challenge_response]
	 */
	new_oidc_challenge_response(challenge: Uint8Array): Promise<void>;
}
/**
 * r" MLS Group Information
 * r"
 * r" This is used when joining by external commit.
 * r" It can be found within the `GroupInfoBundle` within a `CommitBundle`.
 */
export class GroupInfo {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Get the raw bytes from this type, transferring data from Rust to the client layer.
	 *
	 * This does not consume the newtype, instead copying the internal data across the FFI boundary.
	 */
	copyBytes(): Uint8Array;
	/**
	 * Construct a new instance, transferring data from the client layer to Rust.
	 */
	constructor(bytes: Uint8Array);
}
declare class KeyPackage {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Get the raw bytes from this type, transferring data from Rust to the client layer.
	 *
	 * This does not consume the newtype, instead copying the internal data across the FFI boundary.
	 */
	copyBytes(): Uint8Array;
	/**
	 * Construct a new instance, transferring data from the client layer to Rust.
	 */
	constructor(bytes: Uint8Array);
}
/**
 * An entity / data which has been packaged by the application to be encrypted
 * and transmitted in an application message.
 */
export class MlsTransportData {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Construct `MlsTransportData` by providing data
	 */
	constructor(buf: Uint8Array);
	/**
	 * The specific data which has been packaged to be encrypted/transmitted.
	 */
	readonly data: Uint8Array;
}
/**
 * Result of an authorization creation.
 *
 * - See <https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5>
 * - See [core_crypto::e2e_identity::types::E2eiNewAcmeAuthz]
 */
export class NewAcmeAuthz {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * DNS entry associated with those challenge
	 */
	readonly identifier: string;
	/**
	 * ACME challenge + ACME key thumbprint
	 */
	readonly keyauth: string | undefined;
	/**
	 * Associated ACME Challenge
	 */
	readonly challenge: AcmeChallenge;
}
/**
 * Result of an order creation.
 *
 * - See <https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4>
 * - See [core_crypto::e2e_identity::types::E2eiNewAcmeOrder]
 */
export class NewAcmeOrder {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Opaque raw json value
	 */
	readonly delegate: Uint8Array;
	/**
	 * Authorizations to create with `new_authz_request`
	 */
	readonly authorizations: string[];
}
declare class ProteusAutoPrekeyBundle {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Prekey id (automatically incremented)
	 */
	readonly id: number;
	/**
	 * CBOR serialization of prekey
	 */
	readonly pkb: Uint8Array;
}
/**
 * r" A secret key derived from the group secret.
 * r"
 * r" This is intended to be used for AVS.
 */
export class SecretKey {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Get the raw bytes from this type, transferring data from Rust to the client layer.
	 *
	 * This does not consume the newtype, instead copying the internal data across the FFI boundary.
	 */
	copyBytes(): Uint8Array;
	/**
	 * Construct a new instance, transferring data from the client layer to Rust.
	 */
	constructor(bytes: Uint8Array);
}
/**
 * r" A TLS-serialized Welcome message.
 * r"
 * r" This structure is defined in RFC 9420:
 * r" <https://www.rfc-editor.org/rfc/rfc9420.html#joining-via-welcome-message>.
 */
export class Welcome {
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Get the raw bytes from this type, transferring data from Rust to the client layer.
	 *
	 * This does not consume the newtype, instead copying the internal data across the FFI boundary.
	 */
	copyBytes(): Uint8Array;
	/**
	 * Construct a new instance, transferring data from the client layer to Rust.
	 */
	constructor(bytes: Uint8Array);
}
/**
 * see [core_crypto::prelude::WelcomeBundle]
 */
export class WelcomeBundle {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Identifier of the joined conversation
	 */
	readonly id: ConversationId;
	/**
	 * New CRL Distribution of members of this group
	 */
	readonly crlNewDistributionPoints: string[] | undefined;
}
/**
 * Represents the identity claims identifying a client
 * Those claims are verifiable by any member in the group
 */
export class WireIdentity {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * Unique client identifier e.g. `T4Coy4vdRzianwfOgXpn6A:6add501bacd1d90e@whitehouse.gov`
	 */
	readonly clientId: string;
	/**
	 * Status of the Credential at the moment this object is created
	 */
	readonly status: DeviceStatus;
	/**
	 * MLS thumbprint
	 */
	readonly thumbprint: string;
	/**
	 * Indicates whether the credential is Basic or X509
	 */
	credentialType: CredentialType;
	/**
	 * In case 'credential_type' is [CredentialType::X509] this is populated
	 */
	readonly x509Identity: X509Identity | undefined;
}
/**
 * Represents the parts of [WireIdentity][crate::WireIdentity] that are specific to a X509 certificate (and not a Basic one).
 *
 * We don't use an enum here since the sole purpose of this is to be exposed through the FFI (and
 * union types are impossible to carry over the FFI boundary)
 */
export class X509Identity {
	private constructor();
	free(): void;
	[Symbol.dispose](): void;
	/**
	 * user handle e.g. `john_wire`
	 */
	readonly handle: string;
	/**
	 * Name as displayed in the messaging application e.g. `John Fitzgerald Kennedy`
	 */
	readonly displayName: string;
	/**
	 * DNS domain for which this identity proof was generated e.g. `whitehouse.gov`
	 */
	readonly domain: string;
	/**
	 * X509 certificate identifying this client in the MLS group ; PEM encoded
	 */
	readonly certificate: string;
	/**
	 * X509 certificate serial number
	 */
	readonly serialNumber: string;
	/**
	 * X509 certificate not before as Unix timestamp
	 */
	readonly notBefore: bigint;
	/**
	 * X509 certificate not after as Unix timestamp
	 */
	readonly notAfter: bigint;
}
interface ConversationConfiguration$1 {
	/**
	 * The ciphersuite which should be used to encrypt this conversation.
	 */
	ciphersuite?: Ciphersuite;
	/**
	 * List of client IDs that are allowed to be external senders
	 */
	externalSenders?: ExternalSenderKey[];
	/**
	 *  Duration in seconds after which we will automatically force a self-update commit
	 *  Note: This isn't currently implemented
	 */
	keyRotationSpan?: number;
	/**
	 * Defines if handshake messages are encrypted or not
	 * Note: encrypted handshake messages are not supported by wire-server
	 */
	wirePolicy?: WirePolicy;
}
/**
 * The error structure produced by our rust code.
 **/
export interface CoreCryptoRichError<T extends ErrorType> {
	message: string;
	error_name?: string;
	error_stack?: string[];
	type?: T;
	context?: ErrorContext[T];
}
/**
 * Error wrapper that takes care of extracting rich error details across the FFI (through JSON parsing)
 *
 * Whenever you're supposed to get this class (that extends `Error`) you might end up with a base `Error`
 * in case the parsing of the message structure fails. This is unlikely but the case is still covered and fall backs automatically.
 * More information will be found in the base `Error.cause` to inform you why the parsing has failed.
 *
 * Please note that in this case the extra properties will not be available.
 */
export declare class CoreCryptoError<T extends ErrorType> extends Error {
	errorStack: string[];
	context?: ErrorContext[T];
	type?: T;
	private constructor();
	private static fallback;
	static build<E extends ErrorType>(msg: string, ...params: unknown[]): CoreCryptoError<E>;
	static fromStdError(e: Error): CoreCryptoError<ErrorType>;
	static asyncMapErr<T, E extends ErrorType>(p: Promise<T>): Promise<T>;
}
/**
 * Helper type to ensure that error contexts match their type
 */
export type ErrorTypeWithContext<T> = {
	[K in keyof T]: {
		type: K;
		context: T[K];
	};
}[keyof T];
/**
 * Variants of core crypto errors
 */
export declare enum ErrorType {
	Mls = "Mls",
	Proteus = "Proteus",
	E2ei = "E2ei",
	TransactionFailed = "TransactionFailed",
	Other = "Other"
}
export declare function isCcError<E extends ErrorType>(error: unknown, errorType: E): error is CoreCryptoError<E>;
/**
 * Structured core crypto error
 */
export interface ErrorContext {
	[ErrorType.Mls]: ErrorTypeWithContext<MlsErrorContext>;
	[ErrorType.Proteus]: ErrorTypeWithContext<ProteusErrorContext>;
	[ErrorType.E2ei]: {
		e2eiError: string;
	};
	[ErrorType.TransactionFailed]: {
		error: string;
	};
	[ErrorType.Other]: {
		msg: string;
	};
}
export declare function isE2eiError(error: unknown): error is CoreCryptoError<ErrorType.E2ei>;
export declare function isTransactionFailedError(error: unknown): error is CoreCryptoError<ErrorType.TransactionFailed>;
export declare function isOtherError(error: unknown): error is CoreCryptoError<ErrorType.Other>;
/**
 * Variants of core crypto mls errors
 */
export declare enum MlsErrorType {
	ConversationAlreadyExists = "ConversationAlreadyExists",
	DuplicateMessage = "DuplicateMessage",
	BufferedFutureMessage = "BufferedFutureMessage",
	WrongEpoch = "WrongEpoch",
	BufferedCommit = "BufferedCommit",
	MessageEpochTooOld = "MessageEpochTooOld",
	SelfCommitIgnored = "SelfCommitIgnored",
	UnmergedPendingGroup = "UnmergedPendingGroup",
	StaleProposal = "StaleProposal",
	StaleCommit = "StaleCommit",
	/**
	 * This happens when the DS cannot flag KeyPackages as claimed or not. In this scenario, a client
	 * requests their old KeyPackages to be deleted but one has already been claimed by another client to create a Welcome.
	 * In that case the only solution is that the client receiving such a Welcome tries to join the group
	 * with an External Commit instead
	 */
	OrphanWelcome = "OrphanWelcome",
	MessageRejected = "MessageRejected",
	Other = "Other"
}
/**
 * Structured core crypto mls error (embedded in a core crypto error)
 */
export interface MlsErrorContext {
	[MlsErrorType.ConversationAlreadyExists]: {
		conversationId: Array<number>;
	};
	[MlsErrorType.DuplicateMessage]: Record<string, never>;
	[MlsErrorType.BufferedFutureMessage]: Record<string, never>;
	[MlsErrorType.WrongEpoch]: Record<string, never>;
	[MlsErrorType.BufferedCommit]: Record<string, never>;
	[MlsErrorType.MessageEpochTooOld]: Record<string, never>;
	[MlsErrorType.SelfCommitIgnored]: Record<string, never>;
	[MlsErrorType.UnmergedPendingGroup]: Record<string, never>;
	[MlsErrorType.StaleProposal]: Record<string, never>;
	[MlsErrorType.StaleCommit]: Record<string, never>;
	[MlsErrorType.OrphanWelcome]: Record<string, never>;
	[MlsErrorType.MessageRejected]: {
		reason: string;
	};
	[MlsErrorType.Other]: {
		msg: string;
	};
}
export declare function isMlsError<E extends MlsErrorType>(error: unknown, errorType: E): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: E;
	}>;
};
export declare function isMlsConversationAlreadyExistsError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.ConversationAlreadyExists;
	}>;
};
export declare function isMlsDuplicateMessageError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.DuplicateMessage;
	}>;
};
export declare function isMlsBufferedFutureMessageError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.BufferedFutureMessage;
	}>;
};
export declare function isMlsWrongEpochError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.WrongEpoch;
	}>;
};
export declare function isMlsBufferedCommitError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.BufferedCommit;
	}>;
};
export declare function isMlsSelfCommitIgnoredError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.SelfCommitIgnored;
	}>;
};
export declare function isMlsUnmergedPendingGroupError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.UnmergedPendingGroup;
	}>;
};
export declare function isMlsStaleProposalError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.StaleProposal;
	}>;
};
export declare function isMlsStaleCommitError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.StaleCommit;
	}>;
};
export declare function isMlsOrphanWelcomeError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.OrphanWelcome;
	}>;
};
export declare function isMlsMessageRejectedError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.MessageRejected;
	}>;
};
export declare function isMlsOtherError(error: unknown): error is CoreCryptoError<ErrorType.Mls> & {
	context: Extract<ErrorContext[ErrorType.Mls], {
		type: MlsErrorType.Other;
	}>;
};
/**
 * Variants of core crypto proteus errors
 */
export declare enum ProteusErrorType {
	SessionNotFound = "SessionNotFound",
	DuplicateMessage = "DuplicateMessage",
	RemoteIdentityChanged = "RemoteIdentityChanged",
	Other = "Other"
}
/**
 * Structured core crypto proteus error (embedded in a core crypto error)
 */
export interface ProteusErrorContext {
	[ProteusErrorType.SessionNotFound]: {
		errorCode: number;
	};
	[ProteusErrorType.DuplicateMessage]: {
		errorCode: number;
	};
	[ProteusErrorType.RemoteIdentityChanged]: {
		errorCode: number;
	};
	[ProteusErrorType.Other]: {
		errorCode: number;
	};
}
export declare function isProteusError<E extends ProteusErrorType>(error: unknown, errorType: E): error is CoreCryptoError<ErrorType.Proteus> & {
	context: Extract<ErrorContext[ErrorType.Proteus], {
		type: E;
	}>;
};
export declare function isProteusSessionNotFoundError(error: unknown): error is CoreCryptoError<ErrorType.Proteus> & {
	context: Extract<ErrorContext[ErrorType.Proteus], {
		type: ProteusErrorType.SessionNotFound;
	}>;
};
export declare function isProteusDuplicateMessageError(error: unknown): error is CoreCryptoError<ErrorType.Proteus> & {
	context: Extract<ErrorContext[ErrorType.Proteus], {
		type: ProteusErrorType.DuplicateMessage;
	}>;
};
export declare function isProteusRemoteIdentityChangedError(error: unknown): error is CoreCryptoError<ErrorType.Proteus> & {
	context: Extract<ErrorContext[ErrorType.Proteus], {
		type: ProteusErrorType.RemoteIdentityChanged;
	}>;
};
export declare function isProteusOtherError(error: unknown): error is CoreCryptoError<ErrorType.Proteus> & {
	context: Extract<ErrorContext[ErrorType.Proteus], {
		type: ProteusErrorType.Other;
	}>;
};
/**
 * Alias for proposal reference. It is a byte array of size 16.
 */
export type ProposalRef = Uint8Array;
/**
 * A `HistorySecret` encodes sufficient client state that it can be used to instantiate an
 * ephemeral client.
 */
export interface HistorySecret {
	clientId: ClientId;
	data: Uint8Array;
}
/**
 * Data shape for a MLS generic commit + optional bundle (aka stapled commit & welcome)
 */
export interface CommitBundle {
	/**
	 * TLS-serialized MLS Commit that needs to be fanned out to other (existing) members of the conversation
	 *
	 * @readonly
	 */
	commit: Uint8Array;
	/**
	 * Optional TLS-serialized MLS Welcome message that needs to be fanned out to the clients newly added to the conversation
	 *
	 * @readonly
	 */
	welcome?: Welcome;
	/**
	 * MLS GroupInfo which is required for joining a group by external commit
	 *
	 * @readonly
	 */
	groupInfo: GroupInfoBundle;
	/**
	 * An encrypted message to fan out to all other conversation members in the new epoch
	 * @readonly
	 */
	encryptedMessage?: Uint8Array;
}
/**
 * Wraps a GroupInfo in order to efficiently upload it to the Delivery Service.
 * This is not part of MLS protocol but parts might be standardized at some point.
 */
export interface GroupInfoBundle {
	/**
	 * see {@link GroupInfoEncryptionType}
	 */
	encryptionType: MlsGroupInfoEncryptionType;
	/**
	 * see {@link RatchetTreeType}
	 */
	ratchetTreeType: MlsRatchetTreeType;
	/**
	 * TLS-serialized GroupInfo
	 */
	payload: GroupInfo;
}
/**
 * This is a wrapper for all the possible outcomes you can get after decrypting a message
 */
interface DecryptedMessage$1 {
	/**
	 * Raw decrypted application message, if the decrypted MLS message is an application message
	 */
	message?: Uint8Array;
	/**
	 * It is set to false if ingesting this MLS message has resulted in the client being removed from the group (i.e. a Remove commit)
	 */
	isActive: boolean;
	/**
	 * Commit delay hint (in milliseconds) to prevent clients from hammering the server with epoch changes
	 */
	commitDelay?: number;
	/**
	 * Client identifier of the sender of the message being decrypted. Only present for application messages.
	 */
	senderClientId?: ClientId;
	/**
	 * true when the decrypted message resulted in an epoch change i.e. it was a commit
	 */
	hasEpochChanged: boolean;
	/**
	 * Identity claims present in the sender credential
	 * Only present when the credential is a x509 certificate
	 * Present for all messages
	 */
	identity?: WireIdentity;
	/**
	 * Only set when the decrypted message is a commit.
	 * Contains buffered messages for next epoch which were received before the commit creating the epoch
	 * because the DS did not fan them out in order.
	 */
	bufferedMessages?: BufferedDecryptedMessage$1[];
	/**
	 * New CRL distribution points that appeared by the introduction of a new credential
	 */
	crlNewDistributionPoints?: string[];
}
/**
 * Almost same as {@link DecryptedMessage} but avoids recursion
 */
interface BufferedDecryptedMessage$1 {
	/**
	 * see {@link DecryptedMessage.message}
	 */
	message?: Uint8Array;
	/**
	 * see {@link DecryptedMessage.isActive}
	 */
	isActive: boolean;
	/**
	 * see {@link DecryptedMessage.commitDelay}
	 */
	commitDelay?: number;
	/**
	 * see {@link DecryptedMessage.senderClientId}
	 */
	senderClientId?: ClientId;
	/**
	 * see {@link DecryptedMessage.hasEpochChanged}
	 */
	hasEpochChanged: boolean;
	/**
	 * see {@link DecryptedMessage.identity}
	 */
	identity?: WireIdentity;
	/**
	 * see {@link DecryptedMessage.crlNewDistributionPoints}
	 */
	crlNewDistributionPoints?: string[];
}
/**
 * Returned by {@link MlsTransport} callbacks.
 */
export type MlsTransportResponse = "success" | "retry" | {
	/**
	 * The message was rejected by the delivery service and there's no recovery.
	 */
	abort: {
		reason: string;
	};
};
/**
 * An interface that must be implemented and provided to CoreCrypto via
 * {@link CoreCrypto.provideTransport}.
 */
export interface MlsTransport {
	/**
	 * This callback is called by CoreCrypto to send a commit bundle to the delivery service.
	 *
	 * @param commitBundle - the commit bundle
	 * @returns a promise resolving to a {@link MlsTransportResponse}
	 */
	sendCommitBundle: (commitBundle: CommitBundle) => Promise<MlsTransportResponse>;
	/**
	 *  This callback is called by CoreCrypto to send a regular message to the delivery service.
	 * @param message
	 * @returns a promise resolving to a {@link MlsTransportResponse}
	 */
	sendMessage: (message: Uint8Array) => Promise<MlsTransportResponse>;
	/**
	 *  This callback is called by CoreCrypto to prepare a history secret to be sent to the delivery service.
	 * @param secret
	 * @returns a promise resolving to a {@link MlsTransportData}
	 */
	prepareForTransport: (secret: HistorySecret) => Promise<MlsTransportData>;
}
/**
 *  Supporting struct for CRL registration result
 */
export interface CRLRegistration {
	/**
	 * Whether this CRL modifies the old CRL (i.e. has a different revocated cert list)
	 *
	 * @readonly
	 */
	dirty: boolean;
	/**
	 * Optional expiration timestamp
	 *
	 * @readonly
	 */
	expiration?: number;
}
interface AcmeDirectory$1 {
	/**
	 * URL for fetching a new nonce. Use this only for creating a new account.
	 */
	newNonce: string;
	/**
	 * URL for creating a new account.
	 */
	newAccount: string;
	/**
	 * URL for creating a new order.
	 */
	newOrder: string;
	/**
	 * Revocation URL
	 */
	revokeCert: string;
}
/**
 * Returned by APIs whose code paths potentially discover new certificate revocation list distribution URLs.
 */
export type NewCrlDistributionPoints = string[] | undefined;
export type JsonRawData = Uint8Array;
export declare class E2eiEnrollment {
	#private;
	/** @hidden */
	constructor(e2ei: FfiWireE2EIdentity);
	free(): void;
	/**
	 * Should only be used internally
	 */
	inner(): unknown;
	/**
	 * Parses the response from `GET /acme/{provisioner-name}/directory`.
	 * Use this {@link AcmeDirectory} in the next step to fetch the first nonce from the acme server. Use
	 * {@link AcmeDirectory.newNonce}.
	 *
	 * @param directory HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.1.1
	 */
	directoryResponse(directory: JsonRawData): Promise<AcmeDirectory$1>;
	/**
	 * For creating a new acme account. This returns a signed JWS-alike request body to send to
	 * `POST /acme/{provisioner-name}/new-account`.
	 *
	 * @param previousNonce you got from calling `HEAD {@link AcmeDirectory.newNonce}`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.3
	 */
	newAccountRequest(previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/new-account`.
	 * @param account HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.3
	 */
	newAccountResponse(account: JsonRawData): Promise<void>;
	/**
	 * Creates a new acme order for the handle (userId + display name) and the clientId.
	 *
	 * @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/new-account`
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	newOrderRequest(previousNonce: string): Promise<JsonRawData>;
	/**
	 * Parses the response from `POST /acme/{provisioner-name}/new-order`.
	 *
	 * @param order HTTP response body
	 * @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
	 */
	newOrderResponse(order: JsonRawData): Promise<NewAcmeOrder>;
	/**
	 * Creates a new authorization request.
	 *
	 * @param url one of the URL in new o