/**
 * @fileoverview LedgerChainValidator — validates chain integrity by walking
 * entries and checking hashes, signatures, authorization, and governance
 * constraints.
 *
 * Validation does not throw — it returns an IValidationResult with error
 * descriptors. All errors are collected (validation does not stop at the
 * first error).
 *
 * @see Design: Block Chain Ledger — LedgerChainValidator
 * @see Requirements 3.2, 3.3, 4.3–4.6, 8.1–8.4, 12.6–12.7, 13.6–13.7,
 *      14.5, 15.6, 16.1–16.6
 */
import { ILedgerEntry } from '../interfaces/ledger/ledgerEntry';
import { ILedgerSignatureVerifier } from '../interfaces/ledger/ledgerSignatureVerifier';
import { IMerkleProof } from '../interfaces/ledger/merkleProof';
import { IValidationResult } from '../interfaces/ledger/validationResult';
import { Checksum } from '../types/checksum';
import { AuthorizedSignerSet } from './authorizedSignerSet';
import { GovernancePayloadSerializer } from './governancePayloadSerializer';
import { LedgerEntrySerializer } from './ledgerEntrySerializer';
/**
 * Validates ledger chain integrity by walking entries and verifying:
 * - Contiguous sequence numbers
 * - Genesis entry correctness
 * - Hash-chain links (previousEntryHash)
 * - EntryHash recomputation
 * - Signature verification
 * - Authorization (signer is in the authorized set)
 * - Governance constraints (admin role, quorum, safety)
 */
export declare class LedgerChainValidator {
    private readonly serializer;
    private readonly signatureVerifier;
    private readonly governanceSerializer?;
    constructor(serializer: LedgerEntrySerializer, signatureVerifier: ILedgerSignatureVerifier, governanceSerializer?: GovernancePayloadSerializer | undefined);
    /**
     * Validate the entire chain from genesis to head.
     *
     * Expects entries ordered by sequenceNumber starting from 0.
     * Returns { isValid: true, entriesChecked: 0, errors: [] } for an empty chain.
     *
     * When a governanceSerializer is provided, also validates:
     * - Genesis entry initializes the signer set
     * - Each entry's signer is authorized at that chain position
     * - Governance entries have admin role and satisfy quorum
     * - Governance actions pass safety constraints
     *
     * When a merkleRoot is provided, also validates:
     * - Reconstructs the Merkle tree from entry hashes
     * - Verifies the computed root matches the provided Merkle root
     *
     * @param entries - The chain entries to validate
     * @param merkleRoot - Optional Merkle root to verify against. When provided,
     *   the validator reconstructs the Merkle tree from entry hashes and compares
     *   the computed root to this value.
     *
     * @see Requirements 11.1, 11.3, 11.4
     */
    validateAll(entries: ILedgerEntry[], merkleRoot?: Checksum): IValidationResult;
    /**
     * Validate a sub-range of entries, including the link to the predecessor.
     *
     * @param entries - The sub-range of entries to validate (ordered by sequenceNumber).
     * @param predecessor - The entry immediately before the sub-range, or null if
     *   the sub-range starts at genesis.
     * @param signerSetAtPredecessor - Optional AuthorizedSignerSet state at the predecessor
     *   for governance validation of the sub-range.
     * @param merkleRoot - Optional Merkle root to verify entry hashes against.
     *   When provided along with merkleProofs, each entry's entryHash is verified
     *   against its corresponding Merkle proof.
     * @param merkleProofs - Optional array of Merkle proofs corresponding 1:1 with
     *   the entries array. Required for Merkle validation when merkleRoot is provided.
     *
     * @see Requirements 11.2
     */
    validateRange(entries: ILedgerEntry[], predecessor: ILedgerEntry | null, signerSetAtPredecessor?: AuthorizedSignerSet, merkleRoot?: Checksum, merkleProofs?: IMerkleProof[]): IValidationResult;
    /**
     * Validate the entire chain in parallel by splitting into chunks and
     * verifying each chunk concurrently via Promise.all.
     *
     * Produces the same validation result as sequential `validateAll()`:
     * same `isValid`, same `entriesChecked`, same error types (though error
     * ordering may differ).
     *
     * Hash verification and signature verification — the expensive operations —
     * run in parallel across chunks. Governance validation is run as a separate
     * sequential pass since it requires tracking the AuthorizedSignerSet state
     * across the chain.
     *
     * @param entries - The chain entries to validate (ordered by sequenceNumber from 0)
     * @param merkleRoot - Optional Merkle root to verify against
     * @returns Promise resolving to the same IValidationResult as validateAll()
     *
     * @see Requirements 17.1, 17.2, 17.3
     */
    validateAllParallel(entries: ILedgerEntry[], merkleRoot?: Checksum): Promise<IValidationResult>;
    /**
     * Run governance validation sequentially across the full chain.
     * This is separated from the parallel chunk validation because governance
     * requires tracking the AuthorizedSignerSet state across entries.
     */
    private validateGovernanceSequential;
    /**
     * Initialize the AuthorizedSignerSet from a genesis entry.
     * Returns the signer set, or null if the genesis is not a valid governance payload.
     */
    private initSignerSetFromGenesis;
    /**
     * Validate authorization and governance constraints for a non-genesis entry.
     * If the entry is a governance payload, also validates admin role, quorum,
     * and applies actions to the signer set.
     */
    private validateEntryAuthorization;
    /**
     * Recompute the entryHash for the given entry and compare it to the
     * stored entryHash. Pushes an error if they don't match.
     */
    private verifyEntryHash;
    /**
     * Verify the entry's signature against its signerPublicKey and entryHash.
     * Pushes an error if verification fails.
     */
    private verifySignature;
}
//# sourceMappingURL=ledgerChainValidator.d.ts.map