export type Hex = `0x${string}`;
export declare const ensure0x: (h: string) => Hex;
/** keccak256 of 0x-hex bytes, returned as 0x-hex. */
export declare function keccak256(hex: string): Hex;
/**
 * 4-byte function selector for a canonical signature, e.g.
 * "approve(address,uint256)". Encodes the signature as ASCII bytes directly
 * (signatures are always ASCII) so the action depends only on ethers/Lit.Actions
 * globals — no TextEncoder, no Node builtins, nothing the TEE might not provide.
 */
export declare function functionSelector(signature: string): Hex;
/** Lowercase address compare (we never need checksums for policy decisions). */
export declare const eqAddr: (a?: string, b?: string) => boolean;
/** Left-pad a bigint/decimal-string to a 32-byte ABI word (no 0x). */
export declare function word(value: bigint | number | string): string;
/** Left-pad an address to a 32-byte ABI word (no 0x). */
export declare function addressWord(addr: string): string;
/** A 32-byte value already (bytes32 / keccak result) → bare word (no 0x). */
export declare function bytes32Word(hex32: string): string;
/** Pack a uint into a 16-byte half-word (no 0x) — for v0.7 packed gas fields. */
export declare function u128(value: bigint | number | string): string;
/** Concatenate hex pieces (with or without 0x) into a single 0x-hex string. */
export declare function concatHex(...parts: string[]): Hex;
/** A decoded EVM call recovered from Kernel execution calldata. */
export interface DecodedCall {
    to: Hex;
    value: bigint;
    data: Hex;
}
/** Canonical ABI encoding of `(address,uint256,bytes)[]` (the batch payload). */
export declare function encodeExecutionBatch(calls: DecodedCall[]): Hex;
/** Canonical packed encoding of a single Kernel execution: `to(20) ‖ value(32) ‖ data`. */
export declare function encodeExecutionSingle(call: DecodedCall): Hex;
/**
 * Decode the ABI encoding of a single `(address target, uint256 value, bytes
 * callData)[]` parameter (the Kernel batch executionCalldata), then REJECT
 * anything that is not its own canonical encoding. Re-encoding and comparing
 * means we only accept bytes that Solidity's ABI decoder resolves to the exact
 * same calls — closing the decoder-vs-EVM disagreement class (non-canonical
 * offsets, aliased pointers, dirty address high-bytes, trailing data) rather
 * than trying to hand-verify every bounds case. Bounds-safe reads throw on
 * truncation; the caller treats any throw as a refusal (fail closed).
 */
export declare function decodeExecutionBatch(executionCalldata: string): DecodedCall[];
/** Decode a single packed Kernel execution: `to(20) ‖ value(32) ‖ data`. */
export declare function decodeExecutionSingle(executionCalldata: string): DecodedCall;