/**
 * federation/index.ts — top-level orchestrator + public exports.
 *
 * F-038 — composes the eight federation primitives into a single
 * `createFederation(opts)` factory. The orchestrator wires:
 *
 *   sign    — produce a signed FederationEnvelope (with fresh nonce +
 *             PII redaction + audit log entry).
 *   verify  — verify an inbound envelope (HMAC + nonce window +
 *             trust + policy + audit log entry).
 *   send    — high-level helper: sign + persist outgoing audit.
 *   receive — high-level helper: verify + accept-or-reject + persist
 *             inbound audit.
 *   status  — snapshot for the `federation_status` MCP tool.
 *
 * No native deps. Pure TS over Node `crypto` + `fs`.
 */
import { canonicalSignablePayload, type EnvelopeBudget, type FederationEnvelope, type FederationMessageType } from "./envelope.js";
import { NonceCache } from "./hmac.js";
import { type PiiMode, type PiiResult } from "./pii.js";
import { TrustEvaluator, type PeerState } from "./trust.js";
import { PolicyEngine } from "./policy.js";
import { AuditService } from "./audit.js";
import { FederationBudget, type PerPeerBudget } from "./budget.js";
export { FEDERATION_MESSAGE_TYPES, TRUST_AFFECTING_MESSAGE_TYPES, isFederationMessageType, canonicalSignablePayload, envelopeAgeMs, emptyScanResult, type EnvelopeBudget, type FederationEnvelope, type FederationMessageType, type PiiScanAction, type PiiScanDetection, type PiiScanResult, } from "./envelope.js";
export { DEFAULT_NONCE_WINDOW_MS, NonceCache, freshNonce, signEnvelope, verifySignature, type VerifyOptions, type VerifyOutcome, } from "./hmac.js";
export { PII_MODES, isPiiMode, PiiPipeline, apply, type ApplyOptions, type PiiAction, type PiiCategory, type PiiDetection, type PiiMode, type PiiResult, } from "./pii.js";
export { MAX_TRUST_AGE_MS, MIN_TRUST_SCORE, TrustEvaluator, type PeerState, type TrustDecision, } from "./trust.js";
export { DEFAULT_MAX_HOPS, PolicyEngine, type PolicyConfig, type PolicyDecision, } from "./policy.js";
export { DEFAULT_AUDIT_PATH, AuditService, type AuditDecision, type AuditEntry, type AuditServiceOpts, } from "./audit.js";
export { DEFAULT_BUDGET_PATH, MAX_TOKENS_CEILING, MAX_USD_CEILING, FederationBudget, validateBudgetInput, type FederationBudgetOpts, type PerPeerBudget, type ReserveResult, } from "./budget.js";
export interface FederationStatusSnapshot {
    readonly nodeId: string;
    readonly nonceCacheSize: number;
    readonly auditSizeBytes: number;
    readonly auditPath: string;
    readonly budget: {
        readonly path: string;
        readonly perPeer: readonly PerPeerBudget[];
        readonly outstandingReservations: number;
    };
    readonly peers: readonly PeerState[];
}
export interface CreateFederationOpts {
    /** Local node id stamped into audit + status payloads. */
    readonly nodeId: string;
    /** Shared HMAC secret. Sender + receiver MUST match. */
    readonly secret: string;
    /** PII redaction mode applied on `sign()`. */
    readonly piiMode?: PiiMode;
    /** Override audit log path. */
    readonly auditPath?: string;
    /** Override budget JSON path. */
    readonly budgetPath?: string;
    /** Optional explicit PolicyEngine (for custom allowlists/blocklists). */
    readonly policy?: PolicyEngine;
    /** Optional explicit TrustEvaluator (custom allowlist). */
    readonly trust?: TrustEvaluator;
    /** Optional explicit AuditService (test-only override). */
    readonly audit?: AuditService;
    /** Optional explicit FederationBudget (test-only override). */
    readonly budget?: FederationBudget;
}
export interface FederationHandle {
    readonly nodeId: string;
    /** PII redaction mode currently in effect. */
    getPiiMode(): PiiMode;
    setPiiMode(mode: PiiMode): void;
    /** Sign + redact + audit. The resulting envelope is ready to
     *  transmit to the peer. */
    sign<T>(input: SignInput<T>): FederationEnvelope<T>;
    /** Verify + admit-or-reject + audit. The caller decides what
     *  to do with the result. */
    receive<T>(envelope: FederationEnvelope<T>): ReceiveResult;
    /** Snapshot for the `federation_status` MCP tool. */
    status(): FederationStatusSnapshot;
    /** Direct access to the underlying services — for advanced
     *  consumers + tests. */
    readonly services: {
        readonly trust: TrustEvaluator;
        readonly policy: PolicyEngine;
        readonly audit: AuditService;
        readonly budget: FederationBudget;
        readonly nonces: NonceCache;
    };
}
export interface SignInput<T> {
    readonly targetNodeId: string;
    readonly sessionId: string;
    readonly messageType: FederationMessageType;
    readonly payload: T;
    readonly budget?: EnvelopeBudget;
    /** If true, skip PII redaction. Defaults to false. */
    readonly skipPii?: boolean;
}
export interface ReceiveResult {
    readonly trusted: boolean;
    readonly policyAllowed: boolean;
    readonly hmacValid: boolean;
    readonly pii: PiiResult;
    readonly envelope: FederationEnvelope;
    readonly rejectionReason?: string;
}
export declare class FederationPiiBlockedError extends Error {
    readonly code: "PII_BLOCKED";
    readonly detections: readonly PiiResult["detections"][number][];
    constructor(result: PiiResult);
}
/** Build the orchestrator handle. */
export declare function createFederation(opts: CreateFederationOpts): FederationHandle;
export { canonicalSignablePayload as buildSignablePayload };
export declare function freshEnvelopeId(): string;
//# sourceMappingURL=index.d.ts.map