import type { lib as KeetaNetLib } from '@keetanetwork/keetanet-client';
import { KeetaAnchorUserError } from './error.js';
type Account = InstanceType<typeof KeetaNetLib.Account>;
/**
 * Current envelope format version.
 */
export declare const ANCHOR_EXTERNAL_VERSION = 1;
/**
 * Per-anchor entry.
 */
export type AnchorExternalEntry = {
    /**
     * Transaction id at the anchor.
     */
    transactionId: string;
} | {
    /**
     * Persistent forwarding id at the anchor.
     */
    persistentForwardingId: string;
} | {
    /**
     * Opaque destination data interpreted by the anchor (e.g. an EVM
     * address for an EVM anchor).
     */
    destination: string;
};
/**
 * Replay-protection binding for a signed envelope.
 *
 * Pins the signature to a specific position on the signer's account
 * chain so the same signed envelope cannot be reused on a different
 * operation or block.
 */
export type AnchorExternalBinding = {
    /**
     * Block hash that the signer's account had as its head when the
     * SEND carrying this envelope was constructed.
     */
    previousBlockHash: string;
    /**
     * Index of the SEND operation within its block.
     */
    operationIndex: number;
};
/**
 * Decoded anchor-external envelope as exposed to callers.
 */
export type AnchorExternalEnvelope = {
    /**
     * Envelope format version.
     */
    version: typeof ANCHOR_EXTERNAL_VERSION;
    /**
     * Per-anchor entries keyed by `Account.publicKeyString.get()`.
     */
    anchors: {
        [anchorPublicKey: string]: AnchorExternalEntry;
    };
    /**
     * Signature binding. Present if the envelope is signed.
     */
    binding?: AnchorExternalBinding;
};
/**
 * Authenticity record attached to a verified signed envelope. Present only
 * when the signature was verified and the signer appears in
 * {@link AnchorExternalEnvelope.anchors}.
 */
export type AnchorExternalSigned = {
    signer: Account;
};
/**
 * Shape inspection result from {@link AnchorExternal.peek}.
 */
export type AnchorExternalPeekResult = {
    encrypted: boolean;
    signed: boolean;
};
/**
 * Per-anchor entry as it appears in the encoded envelope.
 *
 * `t` = transaction id, `p` = persistent forwarding id, `d` = destination.
 *
 * Note: Single-letter keys keep the envelope smaller.
 */
export type EncodedAnchorExternalEntryV1 = {
    t: string;
} | {
    p: string;
} | {
    d: string;
};
/**
 * Replay-protection binding as it appears in the encoded envelope.
 *
 * `p` = previous block hash, `o` = operation index.
 */
export type EncodedAnchorExternalBindingV1 = {
    p: string;
    o: number;
};
/**
 * Anchor-external envelope as it appears inside the encoded blob.
 *
 * `v` = envelope version, `a` = anchors, `b` = binding.
 */
export type EncodedAnchorExternalEnvelopeV1 = {
    v: typeof ANCHOR_EXTERNAL_VERSION;
    a: {
        [anchorPublicKey: string]: EncodedAnchorExternalEntryV1;
    };
    b?: EncodedAnchorExternalBindingV1;
};
/**
 * Error codes for anchor-external envelope operations.
 */
export declare const AnchorExternalErrorCodes: readonly ["BAD_BASE64", "NOT_AN_ENVELOPE", "UNSUPPORTED_VERSION", "NON_CANONICAL", "PLAINTEXT_TOO_LARGE", "BAD_SIGNATURE", "SIGNER_NOT_LISTED", "MISSING_BINDING", "UNEXPECTED_BINDING", "EXPECTED_PLAIN", "EXPECTED_ENCRYPTED", "OUTPUT_TOO_LARGE"];
export type AnchorExternalErrorCode = typeof AnchorExternalErrorCodes[number];
/**
 * Error raised by anchor-external decode failures.
 */
export declare class AnchorExternalError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly anchorExternalErrorObjectTypeID;
    private static readonly anchorExternalErrorObjectTypeID;
    readonly code: AnchorExternalErrorCode;
    /**
     * Type-narrow an arbitrary string to {@link AnchorExternalErrorCode}.
     */
    static isValidCode(code: string): code is AnchorExternalErrorCode;
    constructor(code: AnchorExternalErrorCode, message: string);
    static isInstance(input: unknown): input is AnchorExternalError;
    toJSON(): ReturnType<KeetaAnchorUserError['toJSON']> & {
        code: AnchorExternalErrorCode;
    };
    static fromJSON(input: unknown): Promise<AnchorExternalError>;
}
/**
 * Fluent builder for constructing an anchor-external envelope and producing
 * its encoded SEND.external string.
 */
export declare class AnchorExternalBuilder {
    #private;
    /**
     * Set the entry for a given anchor, replacing any prior entry
     * for the same anchor.
     */
    setAnchor(anchor: Account, entry: AnchorExternalEntry): this;
    /**
     * Sign the produced envelope with the given account.
     */
    withSigner(signer: Account): this;
    /**
     * Encrypt the produced envelope so each listed principal can decrypt
     * it. Omit to leave the envelope as plaintext.
     */
    withPrincipals(principals: Account[]): this;
    /**
     * Bind the produced signature to a position on the signer's
     * account chain. Required whenever {@link withSigner} is used.
     *
     * @param previousBlockHash Block hash of the signer's current head.
     * @param operationIndex    Index of the SEND operation within its block.
     */
    withBinding(previousBlockHash: string, operationIndex: number): this;
    /**
     * Set an upper bound on the encoded output length. {@link build}
     * throws if the produced string would exceed this length.
     */
    withMaxLength(maxLength: number): this;
    /**
     * Snapshot of the envelope as it would be encoded right now.
     */
    toEnvelope(): AnchorExternalEnvelope;
    /**
     * Produce the encoded SEND.external string.
     *
     * @throws {@link KeetaAnchorError} on caller misuse.
     */
    build(): Promise<string>;
}
/**
 * Immutable, verified view of a parsed SEND.external envelope.
 */
export declare class AnchorExternal {
    #private;
    static readonly Builder: typeof AnchorExternalBuilder;
    private constructor();
    /**
     * Decoded envelope.
     */
    get envelope(): AnchorExternalEnvelope;
    /**
     * `true` if the source blob was encrypted.
     */
    get encrypted(): boolean;
    /**
     * Authenticity record for a verified signed envelope, or `undefined`
     * if the envelope was not signed.
     */
    get signed(): AnchorExternalSigned | undefined;
    /**
     * Decode an external string asserted to be plaintext.
     *
     * @throws {@link AnchorExternalError} `EXPECTED_PLAIN` if the source blob is encrypted.
     */
    static fromPlainExternal(external: string): Promise<AnchorExternal>;
    /**
     * Decode an external string asserted to be encrypted under one of the
     * supplied principals.
     *
     * @throws {@link AnchorExternalError} `EXPECTED_ENCRYPTED` if the source blob is plaintext.
     * @throws {@link KeetaAnchorError} if `principals` is empty.
     */
    static fromEncryptedExternal(external: string, principals: Account[]): Promise<AnchorExternal>;
    /**
     * Inspect encrypted/signed flags of a candidate external string
     * without reading plaintext or requiring a decryption key.
     */
    static peek(external: string): Promise<AnchorExternalPeekResult>;
    /**
     * Create an {@link AnchorExternal} from a container.
     */
    private static fromContainer;
    /**
     * Read the envelope from a container.
     */
    private static readEnvelope;
    /**
     * Read the signed record from a container.
     */
    private static readSigned;
}
export {};
//# sourceMappingURL=anchor-external.d.ts.map