import { type ValidCreateActionArgs } from '@bsv/sdk/wallet/validationHelpers';
import { Script, Transaction } from '@bsv/sdk';
import { Wallet, PendingStorageInput } from '../../Wallet';
import { StorageCreateActionResult, StorageCreateTransactionSdkOutput } from '../../sdk/WalletStorage.interfaces';
import { KeyPair } from '../../sdk/types';
export declare function buildSignableTransaction(dctr: StorageCreateActionResult, args: ValidCreateActionArgs, wallet: Wallet): {
    tx: Transaction;
    amount: number;
    pdi: PendingStorageInput[];
    log: string;
};
/**
 * Verify that the outputs returned by storage for caller-specified outputs match
 * exactly what the caller requested in `args.outputs`.
 *
 * The storage response (`StorageCreateActionResult.outputs`) is ordered, by
 * contract, as: the caller's `args.outputs` in their original order, followed by
 * the optional commission output, followed by storage-provided change outputs.
 * Only the `vout` field is randomized when `randomizeOutputs` is set; the array
 * order is stable. Therefore array index `i` (for `i < args.outputs.length`)
 * corresponds to `args.outputs[i]`.
 *
 * Because the locking script that is ultimately signed is taken from the storage
 * response, an untrusted storage provider must not be allowed to alter the
 * recipient script (or amount) of a caller-specified output. Any mismatch is a
 * hard error. (GHSA-36f9-7rg5-cpf8)
 *
 * @throws WERR_INVALID_PARAMETER if storage omitted, reclassified, or modified
 *   any caller-specified output.
 */
export declare function verifyRequestedOutputsUnchanged(storageOutputs: StorageCreateTransactionSdkOutput[], args: ValidCreateActionArgs): void;
/**
 * Default ceiling for a storage-provided commission (service-charge) output, in
 * satoshis. The commission is the one output whose locking script is taken
 * verbatim from storage and cannot be re-derived or verified client-side, so a
 * malicious storage operator could point it at an attacker address. Capping it
 * bounds the worst-case loss from that single output; honest commissions are far
 * below this. (GHSA-36f9-7rg5-cpf8)
 */
export declare const MAX_STORAGE_COMMISSION_SATOSHIS = 500000;
/**
 * Verify that every storage output beyond the caller's requested outputs is
 * either a change output or the (single, bounded) commission output.
 *
 * The storage response is ordered `[caller outputs][commission?][change...]`;
 * `verifyRequestedOutputsUnchanged` already validates the caller region (indices
 * `< args.outputs.length`). This checks the remainder.
 *
 * Change outputs (`providedBy: 'storage', purpose: 'change'`) are safe at any
 * amount: `buildSignableTransaction` ignores the storage-supplied script and
 * re-derives it client-side (`makeChangeLock` / BRC-29 under the client's own
 * change key), so a change output can only ever pay the client. A change output
 * mislabeled by storage is therefore harmless.
 *
 * The commission output's script, by contrast, is taken verbatim from storage
 * and cannot be verified client-side. A malicious storage could inject an extra
 * output — or relabel one as commission — to redirect funds to an attacker while
 * the caller/UI only sees the requested recipients. To bound that, at most one
 * commission output is allowed and its amount must not exceed `maxCommission`.
 * Any other unrecognized output is rejected outright.
 *
 * @throws WERR_INVALID_PARAMETER if storage returned an unrecognized output, more
 *   than one commission output, or a commission exceeding `maxCommission`.
 */
export declare function verifyUnrequestedOutputsAreChangeOrCommission(storageOutputs: StorageCreateTransactionSdkOutput[], args: ValidCreateActionArgs, maxCommission?: number): void;
/**
 * Derive a change output locking script
 */
export declare function makeChangeLock(out: StorageCreateTransactionSdkOutput, dctr: StorageCreateActionResult, args: ValidCreateActionArgs, changeKeys: KeyPair, wallet: Wallet): Script;
//# sourceMappingURL=buildSignableTransaction.d.ts.map