import type * as KeetaNetClient from '@keetanetwork/keetanet-client';
import * as KeetaNet from '@keetanetwork/keetanet-client';
import { Certificate } from '../certificates.js';
type AccountKeyAlgorithm = InstanceType<typeof KeetaNetClient.lib.Account>['keyType'];
type KeetaNetAccount = ReturnType<typeof KeetaNetClient.lib.Account.fromSeed<AccountKeyAlgorithm>>;
type KeetaNetNetwork = typeof KeetaNet.Client.Config.networksArray[number];
/**
 * Outcome of verifying an account's on-chain cert chain against a trust
 * set:
 *
 * - `'trusted'`: at least one published cert chains to a trusted issuer.
 * - `'no-certs'`: account has no published certificates.
 * - `'untrusted'`: certs exist but none chain to a trusted issuer.
 */
export type CertificateChainStatus = 'trusted' | 'no-certs' | 'untrusted';
/**
 * Verify that the supplied account has at least one on-chain certificate
 * whose chain terminates at one of the supplied trusted issuers.
 */
export declare function verifyAccountCertificateChain(args: {
    account: KeetaNetAccount;
    client: InstanceType<typeof KeetaNetClient.Client>;
    trustedIssuers: Certificate[];
}): Promise<CertificateChainStatus>;
/**
 * Public configuration for the on-chain certificate-chain gate. Pass on a
 * server config (`requireCertificateChain`) to require that every authenticated
 * caller has at least one published certificate chaining to one of `trustedIssuers`.
 */
export interface CertificateChainConfig {
    trustedIssuers: Certificate[];
    client: InstanceType<typeof KeetaNetClient.Client>;
}
/**
 * Post-validation form of {@link CertificateChainConfig}. `acceptedIssuerDNs`
 * is precomputed once so error payloads don't re-walk `trustedIssuers`.
 */
export interface ResolvedCertificateChainRequirement {
    readonly trustedIssuers: Certificate[];
    readonly client: InstanceType<typeof KeetaNetClient.Client>;
    readonly acceptedIssuerDNs: {
        name: string;
        value: string;
    }[][];
}
/**
 * Validate and freeze a `CertificateChainConfig`.
 */
export declare function resolveCertificateChainConfig(config: CertificateChainConfig | undefined): ResolvedCertificateChainRequirement | undefined;
/**
 * Default delimiter used by {@link certificateChainConfigFromBundle} to
 * separate concatenated PEM-encoded certificates in a single string.
 */
export declare const DEFAULT_CERTIFICATE_BUNDLE_DELIMITER = "|";
/**
 * Arguments accepted by {@link certificateChainConfigFromBundle}.
 */
export interface CertificateChainConfigFromBundleArgs {
    /**
     * One or more PEM-encoded certificates joined with `delimiter`.
     */
    pemBundle: string;
    /**
     * KeetaNet network used to instantiate the client.
     */
    network: KeetaNetNetwork;
    /**
     * Delimiter used to split `pemBundle`. Defaults to
     * {@link DEFAULT_CERTIFICATE_BUNDLE_DELIMITER}.
     */
    delimiter?: string;
}
/**
 * Build a {@link CertificateChainConfig} from a delimited PEM bundle and a network.
 */
export declare function certificateChainConfigFromBundle(args: CertificateChainConfigFromBundleArgs): CertificateChainConfig;
/**
 * Verify the signing account's on-chain certificate chain against the
 * resolved requirement. Throws `KeetaAnchorCertificateRequiredError` when
 * the gate is configured and the account fails it.
 */
export declare function assertAccountCertificateChain(account: KeetaNetAccount, requirement: ResolvedCertificateChainRequirement | undefined): Promise<void>;
export {};
//# sourceMappingURL=certificate-network.d.ts.map