import { PublicSignKey } from "@peerbit/crypto";
import { Program, type ProgramClient, type ProgramInitializationOptions } from "@peerbit/program";
/**
 * Decode-only TrustedNetwork v2 codec scaffold.
 *
 * This module is intentionally absent from the package entry point. It pins
 * the policy, resource-fence-body, and operation-proof wire contracts without
 * exposing a usable controller, resource validator, or encryption path.
 */
export declare const TRUSTED_NETWORK_V2_PROTOCOL_VERSION = 2;
export declare const TRUSTED_NETWORK_V2_POLICY_HASH_SHA256 = 1;
/**
 * Authority-record profile 1 accepts only a policy-snapshot or resource-fence
 * EntryV0 whose normal toSignable() bytes (including causal metadata) have
 * exactly one successfully verified signature. The signer's canonical
 * public-key bytes must equal the descriptor authority. Protected-resource
 * adapters must define a separate bounded profile for operation entries.
 */
export declare const TRUSTED_NETWORK_V2_ENTRY_V0_AUTHORITY_ONLY_SIGNATURE_PROFILE = 1;
/**
 * Consensus ceiling for the canonical serialized EntryV0 carrying a v2 policy
 * snapshot. Every replica applies this exact bound before decoding the entry;
 * it is part of signature profile 1 rather than a replica-local resource knob.
 */
export declare const TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES: number;
/**
 * Consensus bounds for a canonical signed resource-fence EntryV0. These are
 * protocol constants, not resource-adapter configuration.
 */
export declare const TRUSTED_NETWORK_V2_MAX_RESOURCE_FENCE_ENTRY_BYTES: number;
export declare const TRUSTED_NETWORK_V2_MAX_RESOURCE_FENCE_DIRECT_PARENTS = 64;
export declare const TRUSTED_NETWORK_V2_NETWORK_ID_DOMAIN = "peerbit/trusted-network/v2/network-id/v1";
export declare const TRUSTED_NETWORK_V2_POLICY_DIGEST_DOMAIN = "peerbit/trusted-network/v2/policy-body/v1";
/** Fixed first-profile record lengths. Changing either requires a new variant. */
export declare const TRUSTED_NETWORK_V2_RESOURCE_FENCE_BODY_BYTES = 186;
export declare const TRUSTED_NETWORK_V2_OPERATION_POLICY_PROOF_BYTES = 146;
export declare const TrustedNetworkRole: Readonly<{
    readonly ADMIN: 1;
    readonly WRITER: 2;
    readonly READER: 4;
    readonly REPLICATOR: 8;
}>;
export declare const TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS: number;
export declare const exactUint8ArrayByteLengthV2: (value: unknown) => number;
export declare const copyUint8ArrayWithLengthV2: (value: Uint8Array, byteLength: number) => Uint8Array;
export declare const copyUint8ArrayV2: (value: Uint8Array) => Uint8Array;
export declare class NetworkDescriptorV2 {
    protocolVersion: number;
    networkNonce: Uint8Array;
    policyAuthority: PublicSignKey;
    genesisPolicyDigest: Uint8Array;
    policyHashProfile: number;
    entrySignatureProfile: number;
    constructor(properties?: {
        protocolVersion: number;
        networkNonce: Uint8Array;
        policyAuthority: PublicSignKey;
        genesisPolicyDigest: Uint8Array;
        policyHashProfile: number;
        entrySignatureProfile: number;
    });
}
export declare class EncryptionKeyCommitmentV2 {
    profile: number;
    digest: Uint8Array;
    constructor(properties?: {
        profile: number;
        digest: Uint8Array;
    });
}
export declare class PolicySubjectBindingV2 {
    signingKey: PublicSignKey;
    roles: number;
    encryptionKeyCommitment?: EncryptionKeyCommitmentV2;
    constructor(properties?: {
        signingKey: PublicSignKey;
        roles: number;
        encryptionKeyCommitment?: EncryptionKeyCommitmentV2;
    });
}
export declare class PolicySnapshotBodyV2 {
    networkId: Uint8Array;
    sequence: bigint;
    previousPolicyDigest: Uint8Array;
    bindings: PolicySubjectBindingV2[];
    constructor(properties?: {
        networkId: Uint8Array;
        sequence: bigint;
        previousPolicyDigest: Uint8Array;
        bindings: PolicySubjectBindingV2[];
    });
}
/** Canonical unsigned payload intended for an authenticated resource fence. */
export declare class ResourceFenceV2 {
    networkId: Uint8Array;
    resourceId: Uint8Array;
    fenceSequence: bigint;
    previousFenceDigest: Uint8Array;
    policySequence: bigint;
    policyDigest: Uint8Array;
    contentEpoch: bigint;
    epochManifestDigest: Uint8Array;
    constructor(properties?: {
        networkId: Uint8Array;
        resourceId: Uint8Array;
        fenceSequence: bigint;
        previousFenceDigest: Uint8Array;
        policySequence: bigint;
        policyDigest: Uint8Array;
        contentEpoch: bigint;
        epochManifestDigest: Uint8Array;
    });
}
/** Constant-size policy commitment intended for a signed resource operation. */
export declare class OperationPolicyProofV2 {
    networkId: Uint8Array;
    resourceId: Uint8Array;
    policySequence: bigint;
    policyDigest: Uint8Array;
    fenceDigest: Uint8Array;
    contentEpoch: bigint;
    constructor(properties?: {
        networkId: Uint8Array;
        resourceId: Uint8Array;
        policySequence: bigint;
        policyDigest: Uint8Array;
        fenceDigest: Uint8Array;
        contentEpoch: bigint;
    });
}
export declare class TrustedNetworkV2 extends Program<never> {
    descriptor: NetworkDescriptorV2;
    constructor(properties?: {
        descriptor: NetworkDescriptorV2;
    });
    beforeOpen(_node: ProgramClient, _options?: ProgramInitializationOptions<never, this>): Promise<never>;
    open(_args?: never): Promise<never>;
}
export declare const assertNetworkDescriptorV2: (descriptor: NetworkDescriptorV2) => void;
export declare const deriveNetworkIdV2: (descriptor: NetworkDescriptorV2) => Uint8Array;
export declare const digestPolicySnapshotBodyV2: (body: PolicySnapshotBodyV2) => Uint8Array;
export declare const assertPolicySnapshotBodyV2: (body: PolicySnapshotBodyV2, descriptor: NetworkDescriptorV2) => void;
export declare const decodeTrustedNetworkV2: (bytes: Uint8Array) => TrustedNetworkV2;
export declare const decodePolicySnapshotBodyV2: (bytes: Uint8Array, descriptor: NetworkDescriptorV2) => PolicySnapshotBodyV2;
export declare const assertResourceFenceV2: (fence: ResourceFenceV2, descriptor: NetworkDescriptorV2) => void;
export declare const assertOperationPolicyProofV2: (proof: OperationPolicyProofV2, descriptor: NetworkDescriptorV2) => void;
export declare const decodeResourceFenceV2: (bytes: Uint8Array, descriptor: NetworkDescriptorV2) => ResourceFenceV2;
export declare const decodeOperationPolicyProofV2: (bytes: Uint8Array, descriptor: NetworkDescriptorV2) => OperationPolicyProofV2;
//# sourceMappingURL=v2.d.ts.map