/**
 * ZKSimContractProof — Salted hash commitment scheme for SimContract compliance
 * without mesh exposure (paper-1/capstone §ZK).
 *
 * ## What this is
 *
 * This module implements a **salted hash commitment scheme** (commit-reveal
 * protocol).  It provides two classical commitment properties:
 *
 *   • **Binding** — the prover cannot later open the commitment to a different
 *     geometry hash (collision-resistance of the underlying hash function).
 *   • **Hiding** — the commitment reveals nothing about the geometry hash
 *     (pre-image resistance + random salt).
 *
 * Protocol identifier: `'hash-commitment-v1'` (see PROTOCOL constant below).
 *
 * ## What this is NOT
 *
 * This is **NOT** a zero-knowledge proof system and does **NOT** provide
 * zk-SNARK computational integrity guarantees.  In particular:
 *
 *   • The verifier receives no cryptographic proof that the prover executed
 *     the correct simulation program on the committed geometry.
 *   • There is no SNARK/STARK circuit, no witness, and no succinct
 *     non-interactive argument of knowledge.
 *   • The paper-1 citation (§ZK, "ZK-SNARKs for proving SimContract
 *     compliance") describes a *future* direction; this prototype delivers
 *     the privacy property (geometry hiding) only — not the computational
 *     integrity property.
 *
 * The class and export names intentionally retain the "ZK" prefix because
 * they are referenced in the paper-1 manuscript and in external-facing MCP
 * tool contracts.  Renaming them would break the published API.  The
 * protocol's actual nature is documented here and via the PROTOCOL constant.
 *
 * ## Protocol (hash-commitment-v1)
 *
 * 1. **Commit**  (Prover)
 *    commitment ← H(geometryHash ‖ salt)
 *    The prover keeps {geometryHash, salt} secret; shares only commitment.
 *
 * 2. **Prove**  (Prover)
 *    A ZKComplianceProof bundles the commitment with publicly-observable
 *    contract artefacts (fixedDt, solverType, stepCount, per-step state
 *    digests). The raw vertices/elements are NOT included.
 *
 * 3. **Verify**  (Verifier)
 *    Given only the proof, verify:
 *      (a) stepCount > 0 and matches stateDigests.length
 *      (b) commitment is well-formed (non-empty hash string)
 *      (c) per-step digests are all distinct (no frozen solver)
 *      (d) the run timestamp is not in the future
 *    If all checks pass → VALID (geometry privacy preserved; simulation
 *    runtime attestation via state digests).
 *
 * 4. **Open**  (Optional — deferred revelation)
 *    Prover can later reveal (geometryHash, salt); verifier checks
 *    commitment === H(geometryHash ‖ salt).
 *
 * @version 1.0.0 (paper-1 §ZK prototype)
 */
import { type HashMode } from './sha256';
/**
 * Stable machine-readable identifier for the commitment scheme implemented
 * by this module.
 *
 * Value: `'hash-commitment-v1'`
 *
 * This constant exists so that consumers, audit tools, and downstream
 * verifiers can programmatically distinguish this salted hash commitment
 * scheme from a true zero-knowledge proof system.  Include it in any
 * serialized proof envelope that leaves the trust boundary.
 *
 * Protocol properties:
 *   - Binding:  yes (collision-resistance of the underlying hash)
 *   - Hiding:   yes (pre-image resistance + random salt)
 *   - Soundness (computational integrity / zk-SNARK): NO
 */
export declare const PROTOCOL: "hash-commitment-v1";
/** Prover-held secret for the geometry commitment. */
export interface ZKGeometryCommitment {
    /** Public: H(geometryHash ‖ salt) — this is what the prover shares. */
    commitment: string;
    /**
     * Private: the original geometryHash produced by SimulationContract.
     * Kept by prover; revealed only during the optional Opening phase.
     */
    geometryHashPreimage: string;
    /**
     * Private: random blinding factor.
     * Kept by prover; revealed only during the optional Opening phase.
     */
    salt: string;
}
/**
 * Salted hash commitment compliance proof.
 *
 * Everything in this record is safe to share with the verifier.
 * Raw vertex/element data is NOT present — only the commitment is.
 *
 * Note: despite the "ZK" prefix in the type name (preserved for API
 * compatibility with paper-1 references), this is a salted hash commitment
 * scheme — see PROTOCOL constant and module-level doc for details.
 */
export interface ZKComplianceProof {
    /**
     * Protocol identifier.  Always `'hash-commitment-v1'` for proofs produced
     * by this module.  Allows verifiers to detect proofs from future protocol
     * versions or from true zk-SNARK systems.
     */
    protocol: typeof PROTOCOL;
    /** Public commitment to the geometry (hides raw mesh). */
    commitment: string;
    /** Hash mode used to derive the commitment and state digests. */
    hashMode: HashMode;
    /** Solver type label (e.g., "TET4Solver"). */
    solverType: string;
    /** Fixed timestep used by the contract. */
    fixedDt: number;
    /** Total number of deterministic steps taken. */
    stepCount: number;
    /**
     * Per-step state digests from the contracted simulation.
     * Length === stepCount. Each digest proves the solver ran a step.
     * All values are public (no geometry info embedded in state digests
     * because they hash solver field outputs, not mesh data).
     */
    stateDigests: readonly string[];
    /**
     * Per-step GPU output digests (if GPU-backed solver was used).
     * Empty for CPU-only solvers.
     */
    gpuOutputDigests: readonly string[];
    /** SimulationContract run ID (UUID). */
    runId: string;
    /** Wall-clock timestamp of the solve (ms since epoch). */
    timestamp: number;
    /** Human-readable label for the compliance claim. */
    complianceClaim: string;
}
/** Result returned by verifyZKCompliance(). */
export interface ZKVerificationResult {
    /** Whether the proof is valid. */
    valid: boolean;
    /** Zero or more violation messages (empty when valid). */
    violations: string[];
    /** Informational notes about the verification. */
    notes: string[];
}
/**
 * Create a geometry commitment.  Call this BEFORE sharing the proof.
 *
 * @param geometryHash  The geometryHash from ContractedSimulation.getProvenance().
 * @param salt          Optional blinding salt.  If omitted, a random hex string
 *                      is generated using `crypto.getRandomValues()` (or
 *                      `Math.random()` fallback for test environments).
 * @param mode          Hash mode for the commitment (matches ContractConfig).
 */
export declare function commitGeometry(geometryHash: string, salt?: string, mode?: HashMode): ZKGeometryCommitment;
/**
 * Generate a ZKComplianceProof from a finished ContractedSimulation run.
 *
 * The caller must pass the public commitment (from commitGeometry) and the
 * provenance record from the contract.  Raw geometry is NOT required — only
 * the already-computed geometry hash (which is embedded in the commitment).
 *
 * @param commitment  Prover's commitment (commitment field only — not the
 *                    geometryHashPreimage or salt).
 * @param provenance  Value of ContractedSimulation.getProvenance().
 * @param stateDigests  Value of ContractedSimulation.getStateDigests().
 * @param gpuOutputDigests  Value of ContractedSimulation.getGpuOutputDigests().
 * @param mode  Hash mode used by the contract.
 */
export declare function generateComplianceProof(params: {
    commitment: string;
    runId: string;
    solverType: string;
    fixedDt: number;
    stepCount: number;
    stateDigests: readonly string[];
    gpuOutputDigests?: readonly string[];
    hashMode?: HashMode;
    complianceClaim?: string;
    timestamp?: number;
}): ZKComplianceProof;
/**
 * Verify a ZKComplianceProof without seeing the raw geometry.
 *
 * Checks performed (paper-1 §ZK Verifier algorithm):
 *   V1 — commitment is a non-empty, properly-formatted hash string
 *   V2 — stepCount matches stateDigests.length
 *   V3 — stepCount > 0 (at least one step was taken)
 *   V4 — all stateDigests are non-empty strings
 *   V5 — consecutive stateDigests are not identical (no frozen solver)
 *   V6 — fixedDt is finite and strictly positive
 *   V7 — timestamp is not in the future (clock drift tolerance: 60 s)
 *   V8 — if gpuOutputDigests present, length matches stepCount
 */
export declare function verifyZKCompliance(proof: ZKComplianceProof, options?: {
    clockToleranceMs?: number;
}): ZKVerificationResult;
/**
 * Open the commitment — verify that the commitment is consistent with the
 * geometryHash and salt that the prover now reveals.
 *
 * Called by the verifier AFTER receiving the prover's opening revelation.
 */
export declare function openCommitment(commitment: string, geometryHash: string, salt: string, mode?: HashMode): boolean;
//# sourceMappingURL=ZKSimContractProof.d.ts.map