import type { ServerResponse } from "node:http";
import { type PromoteJob, type PromoteJobState } from '@origintrail-official/dkg-publisher';
import type { RequestContext } from './context.js';
/**
 * Build the HTTP-400 body for an on-chain context-graph auto-registration
 * failure that precedes a publish. Shared by `/api/knowledge-assets/:name/vm/publish`
 * and direct KA publish helpers so the
 * funds marker, wording, punctuation trim, and `{ code, error }` shape cannot
 * drift between the two publish routes. On-chain registration is signed by the
 * node's PRIMARY operational wallet (not the funded-wallet-selected publish
 * wallet), so a funds failure here is actionable on that specific wallet.
 */
export declare function buildAutoRegisterFailureBody(contextGraphId: string, regErr: {
    message?: unknown;
    code?: unknown;
} | unknown): {
    code?: string;
    error: string;
};
export type ImportedArtifactResolution = {
    contextGraphId: string;
    assertionUri: string;
    assertionName: string;
    assertionAgentAddress: string;
    subGraphName?: string;
    fileHash: string;
    sourceFileHash: string;
    detectedContentType: string;
    sourceContentType: string;
    extractionStatus: 'completed';
    extractionMethod?: string;
    rootEntity?: string;
    sourceFileName?: string;
    tripleCount?: number;
    structuralTripleCount?: number;
    semanticTripleCount?: number;
    mdIntermediateHash?: string;
    markdownForm?: string;
    markdownHash?: string;
    canReadMarkdown: boolean;
    /**
     * Issue #872 — set to `true` when the request would have been
     * blocked by the legacy owner guard but the CG's on-chain policy
     * (`accessPolicy === 0` AND `publishPolicy === 1`) made the guard
     * inapplicable. The read-markdown route uses this to distinguish
     * "owner request, missing bytes" (genuine corruption) from
     * "cross-agent request, bytes not replicated locally" (expected
     * until the source-artifact gossip follow-up lands). Omitted when
     * the requester IS the assertion owner.
     */
    ownerGuardRelaxed?: boolean;
};
export declare class ImportArtifactRouteError extends Error {
    readonly statusCode: number;
    constructor(statusCode: number, message: string);
}
export declare function validatePromoteJobId(jobId: string): {
    valid: true;
} | {
    valid: false;
    reason: string;
};
export declare function decodePromoteJobId(encoded: string, res: ServerResponse): string | null;
export declare function scopedTokenPromoteLane(agentAddress?: string): {
    agentAddress?: string;
    authorAgentAddress?: string;
};
export interface PromoteJobErrorView {
    code: string;
    message: string;
    retryable: boolean;
}
export interface PromoteJobView {
    jobId: string;
    state: PromoteJobState;
    contextGraphId: string;
    assertionName: string;
    subGraphName?: string;
    entities: readonly string[] | 'all';
    enqueuedAt: string;
    updatedAt: string;
    startedAt?: string;
    finishedAt?: string;
    entitiesPromoted?: number;
    attempts: number;
    maxAttempts: number;
    nextRetryAt?: string;
    lastError?: PromoteJobErrorView;
    reason?: string;
}
export declare function isoFromEpochMs(ms: number | undefined): string | undefined;
export declare function promoteJobToView(job: PromoteJob): PromoteJobView;
export declare function asyncPromoteUnavailable(res: ServerResponse): boolean;
export declare function parseImportedAssertionUri(assertionUri: string, contextGraphId: string, legacyAssertionAgentAddress?: string): {
    assertionAgentAddress: string;
    assertionName: string;
    subGraphName?: string;
    legacy?: boolean;
} | null;
export declare function normalizeSemanticQuads(raw: unknown): Array<{
    subject: string;
    predicate: string;
    object: string;
}>;
export declare function rdfLiteral(value: string): string;
export declare function typedLiteral(value: string | number, typeIri: string): string;
export declare function escapeRdfLiteralBody(value: string): string;
export declare function buildSemanticEnrichmentProvenanceQuads(args: {
    enrichmentUri: string;
    source: ImportedArtifactResolution;
    generatedBy: string;
    generatedAt: string;
    generationMethod: string;
    semanticQuads: Array<{
        subject: string;
        predicate: string;
        object: string;
    }>;
}): Array<{
    subject: string;
    predicate: string;
    object: string;
}>;
export declare function sortAssertionQuads<T>(quads: T[]): T[];
export declare function normalizeMarkdownReadLimit(raw: unknown): number;
export declare function normalizeGeneratedAt(raw: unknown): string;
export declare function normalizeGeneratedBy(raw: unknown, requestAgentAddress: string): string;
export declare function comparableAgentAddress(value: string): string;
export declare function isSameAgentAddress(left: string, right: string): boolean;
export declare function authorizeAgentScopedAuthorClaim(res: ServerResponse, tokenAgentAddress: string | undefined, claimedAuthorAddress: string | undefined, claimField: string): boolean;
export declare function assertImportedArtifactOwnerAddress(assertionAgentAddress: string, requestAgentAddress: string, message: string): void;
/**
 * Issue #872 — public + open context graphs ship their SWM triples to
 * every subscribed peer, so the owner-scoped artifact-read guard is
 * the wrong policy for them: peers that legitimately replicated the
 * triples can't even resolve metadata about the source markdown
 * artifact, let alone fetch its bytes. This helper consults the
 * agent's local on-chain policy cache (populated eagerly by the
 * chain-event poller) to decide whether the guard should be relaxed.
 *
 * Returns `true` only when both policies are confirmed
 * (`accessPolicy === 0` AND `publishPolicy === 1`). Any other state
 * — including missing cache entries — yields `false`, which keeps
 * the existing owner guard in effect (fail-closed).
 *
 * DEFERRED FOLLOW-UP: peers replicate SWM triples but NOT the source
 * artifact bytes; with the guard relaxed, the read-markdown route
 * will return 404 on every cross-agent read until byte-replication is
 * added. Tracked in the PR body for #872.
 */
export declare function isPublicOpenContextGraph(agent: {
    getContextGraphOnChainPolicy?: (id: string) => Promise<{
        accessPolicy?: number;
        publishPolicy?: number;
    }>;
}, contextGraphId: string): Promise<boolean>;
export declare function handleImportArtifactRouteError(res: ServerResponse, err: unknown): boolean;
export declare function resolveImportedArtifact(ctx: RequestContext, raw: Record<string, unknown>, ownerGuard?: {
    requestAgentAddress: string;
    message: string;
    /**
     * Issue #872 / Codex review finding 1: opt-in for the public + open
     * CG owner-guard relaxation. Only the two READ routes
     * (`/import-artifact/resolve`, `/import-artifact/read-markdown`)
     * set this to `true`. The semantic-enrichment WRITE route
     * intentionally leaves it `false` (default) so the strict owner
     * guard remains in effect regardless of the CG's on-chain policy
     * — a non-owner peer on a public + open CG must not be allowed
     * to mutate someone else's imported assertion.
     */
    relaxOnPublicOpenCg?: boolean;
    /**
     * Read routes also allow private/curated CG participants to read imported
     * artifact metadata. Writes intentionally do not set this.
     */
    relaxOnAuthorizedReadCg?: boolean;
}, opts?: {
    allowSharedMemoryFallback?: boolean;
}): Promise<ImportedArtifactResolution>;
export declare function isContextGraphAuthorizedReadAgent(agent: {
    getContextGraphAllowedAgents?: (contextGraphId: string) => Promise<string[]>;
    getContextGraphParticipantAgentAddresses?: (contextGraphId: string) => Promise<string[]>;
}, contextGraphId: string, requestAgentAddress: string): Promise<boolean>;
//# sourceMappingURL=shared-assertion-helpers.d.ts.map