import type { CrashSafeAtomicReplaceStore } from "@peerbit/any-store-interface";
import { PublicSignKey } from "@peerbit/crypto";
import type { PolicyAdmissionResultV2, PolicyForkEvidenceV2, PolicyHeadProjectionV2, PolicySnapshotResolverV2 } from "./v2-policy-engine.js";
import { NetworkDescriptorV2 } from "./v2.js";
/**
 * Internal crash-safe policy-anchor storage format.
 *
 * This module is intentionally absent from the package entry point. Its store
 * must already be open and dedicated to this anchor and descriptor. Exactly
 * one wrapper may write that scope: the two-slot checkpoint deliberately does
 * not pretend that atomic replacement is a multi-process compare-and-swap.
 */
/** The namespace owned by the superseded append-only anchor format. */
export declare const TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER = "peerbit/trusted-network/v2/policy-anchor/v1";
/** Exact maximum encoded application payload accepted by the checkpoint. */
export declare const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES: number;
export type CrashSafePolicyAnchorStoreV2 = CrashSafeAtomicReplaceStore;
type DurableReducerOptionsV2 = {
    descriptor: NetworkDescriptorV2;
    resolvePolicyEntry: PolicySnapshotResolverV2;
    resolveTimeoutMs?: number;
    signal?: AbortSignal;
    maxPending?: number;
    maxPendingPolicyBytes?: number;
};
export type TrustedNetworkV2DurablePolicyReducerOptions = DurableReducerOptionsV2 & {
    store: CrashSafePolicyAnchorStoreV2;
};
export type PolicyLeaseReferenceV2 = {
    sequence: bigint;
    digest: Uint8Array;
    /** Maximum number of authenticated parent edges traversed for this lease. */
    maxSteps?: number;
    /** Absolute wall-clock deadline, in milliseconds since the Unix epoch. */
    deadline?: number;
    /** Relative deadline measured from the call, including operation-queue wait. */
    timeoutMs?: number;
    /** Cancels acquisition of this lease without halting the durable reducer. */
    signal?: AbortSignal;
};
export type AcceptedPolicyLeaseV2 = {
    /** The exact accepted historical policy named by the reference. */
    policy: PolicyHeadProjectionV2;
    /** The durable accepted head observed in the same serialized queue slot. */
    acceptedHead: PolicyHeadProjectionV2;
};
export type PolicyLeaseResultV2<T> = {
    status: "completed";
    value: T;
} | {
    status: "unavailable" | "rejected" | "capacity" | "halted";
    reason: string;
};
/**
 * Crash-safe publication wrapper for the internal v2 reducer.
 *
 * The mutable reducer is never exposed. Authorization reads use only the last
 * projection published after one atomic checkpoint replacement. An admission
 * places a fail-closed fence around both reducer mutation and publication.
 */
export declare class TrustedNetworkV2DurablePolicyReducer {
    private checkpoint?;
    private core;
    private published;
    private durableCoreIdentityBytes?;
    private operationTail;
    private authorizationFences;
    private bufferedOperations;
    private bufferedOperationInputBytes;
    private terminalError?;
    private constructor();
    static open(options: TrustedNetworkV2DurablePolicyReducerOptions): Promise<TrustedNetworkV2DurablePolicyReducer>;
    get state(): "EMPTY" | "ACTIVE" | "UNAVAILABLE" | "FORKED" | "HALTED";
    get head(): PolicyHeadProjectionV2 | undefined;
    get forkEvidence(): PolicyForkEvidenceV2 | undefined;
    get pendingCount(): number;
    get pendingBytes(): number;
    get pendingDigests(): Uint8Array[];
    /** Internal diagnostics for the shared fixed operation-queue bound. */
    get bufferedAdmissionCount(): number;
    /** Internal diagnostics for captured queue-input bytes awaiting settlement. */
    get bufferedAdmissionBytes(): number;
    /** Projection query only; use isAuthorized() for the fail-closed gate. */
    rolesFor(subject: PublicSignKey): number;
    /**
     * Whether the last durable policy projection is ACTIVE with no replacement
     * publication in flight.
     *
     * This is the subject-independent form of the publication fence used by
     * `isAuthorized()`. Internal resource reducers use it to stop serving an
     * otherwise ACTIVE resource while a policy replacement is in flight or the
     * policy anchor has failed closed. It does not prove complete external-log
     * replay or global freshness.
     */
    isUsable(): boolean;
    isAuthorized(subject: PublicSignKey, roles: number): boolean;
    abort(): void;
    ingest(entryBytes: Uint8Array): Promise<PolicyAdmissionResultV2>;
    retryUnavailable(): Promise<PolicyAdmissionResultV2>;
    /**
     * Run one callback while the referenced policy is proven to be an accepted
     * prefix and the durable accepted head is held stable.
     *
     * Lookup and callback execution occupy one operation-queue slot. Callbacks
     * must therefore not await an operation on this same anchor. A callback
     * throw/rejection is propagated unchanged, but never halts the policy anchor.
     */
    withAcceptedPolicyLease<T>(reference: PolicyLeaseReferenceV2, use: (lease: AcceptedPolicyLeaseV2) => T | Promise<T>): Promise<PolicyLeaseResultV2<T>>;
    private forkFailStopResult;
    private lifecycleHaltedResult;
    private immediateLeaseHaltedResult;
    private immediateAdmissionResult;
    private reserveOperation;
    private releaseOperation;
    private enqueue;
    private halt;
    private persistCorePublication;
}
export {};
//# sourceMappingURL=v2-policy-anchor.d.ts.map