/**
 * @pwngh/economy-lab
 *
 * Copyright (c) Preston Neal
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE.md file in the root directory of this source tree.
 *
 * @license MIT
 */
import type { Amount } from '../money.js';
import type { Ctx, Operation, Recipient, Transaction } from '../contract.js';
import type { Digest, Ledger, Saga, Subscription, Unit } from '../ports.js';
/**
 * Narrows `operation` to the expected `kind`. A mismatch means the dispatch is miswired, so it
 * throws a fault rather than process an operation it cannot handle.
 */
export declare function assertKind<K extends Operation['kind']>(operation: Operation, kind: K): asserts operation is Extract<Operation, {
    kind: K;
}>;
/**
 * Requires an operator principal. The submit pipeline already authorizes the actor (authorize in
 * economy.ts), so re-checking here matters only when a handler is called directly, such as from a
 * test. It throws rather than write a privileged change under the wrong actor.
 */
export declare function assertOperator(operation: Operation): void;
/**
 * Requires a non-blank reason on a manual correction, because a correction must record why for
 * auditability. A missing or blank reason is malformed and throws before anything posts.
 */
export declare function assertReason(operation: Extract<Operation, {
    reason: string;
}>): void;
/**
 * The recipient-share law, shared by spend and the instance lane's purchase: at least one
 * recipient, no recipient who is the buyer, no sellerId twice, each share in (0, 10000] basis
 * points, and shares summing to exactly 10000. The sum check alone is not enough — shares like
 * [-5000, 15000] still sum to 10000, but a negative share is a hidden debit and a >100% share
 * pays out more of the part than exists. A buyer who is also a recipient would convert their own
 * non-payable credit into payable earned credit funded by the house, so it is a fault, not a
 * business "no". `what` names the operation in messages; `detail` is merged into every fault.
 */
export declare function assertRecipientShares(recipients: ReadonlyArray<Recipient>, buyerId: string, what: string, detail?: Record<string, string | number>): void;
/**
 * Loads the saga a payout operation names by `sagaId`. An operator or webhook mapping supplied the
 * id, so a missing saga is a caller error: it throws a fault rather than treating the miss as a
 * quiet "nothing to do", matching reverse's unknown-txnId handling.
 */
export declare function loadSaga(unit: Unit, operation: Extract<Operation, {
    sagaId: string;
}>): Promise<Saga>;
/**
 * Builds the `reversed:<id>` idempotency key that marks an order or transaction as undone. Refund
 * and clawback stake it per orderId, which keeps the two reversal paths mutually exclusive, and
 * reverse stakes it per txnId; one builder keeps the key family identical across all three.
 */
export declare function reversalKey(id: string): string;
/**
 * Receipt for an operation that changes state but moves no money: a committed result must carry a
 * Transaction, so this returns one with empty legs and links.
 */
export declare function lifecycleMarker(ctx: Ctx): Transaction;
/**
 * Receipt for the already-handled path: nothing posted this run and the original receipt is not
 * at hand, so return an empty marker rather than mint a fresh id for money that did not move.
 */
export declare function noopTransaction(): Transaction;
/**
 * Re-proves a payout saga against the reserve posting it opened with, before any step trusts the
 * unhashed row: the posting itself re-derives (verifiedPosting), its sealed metadata must name
 * this saga, rate, and USD quote exactly, and its earned-debit leg must carry the reserve. Every
 * money-moving step — the worker's submit, settle, reverse — calls this first, so an edited or
 * fabricated saga row faults CHAIN_BROKEN instead of wiring USD out.
 */
export declare function assertSagaAnchored(deps: {
    ledger: Ledger;
    digest: Digest;
}, saga: Saga): Promise<Amount>;
/**
 * Re-proves a subscription against the first-charge posting it opened with, before a renewal
 * charges by the unhashed row. A row whose id, user, seller, price, or period no longer matches
 * the sealed metadata faults CHAIN_BROKEN instead of shaping the charge — and the anchor is
 * required, because a nullable one would be an anchor the attacker can remove.
 */
export declare function assertSubscriptionAnchored(deps: {
    ledger: Ledger;
    digest: Digest;
}, sub: Subscription): Promise<void>;