export declare const VALID_NIGHTGATE_NETWORKS: readonly ["testnet", "preprod", "mainnet"];
export type NightgateNetwork = (typeof VALID_NIGHTGATE_NETWORKS)[number];
/**
 * Plugin configuration consumed under `cds.requires.nightgate`. CAP injects
 * this object via package.json / .cdsrc / env-var merging. Fields are
 * intentionally optional — defaults come from this module's DEFAULT_* values.
 */
export interface NightgatePluginConfig {
    network?: string;
    nodeUrl?: string;
    indexerHttpUrl?: string;
    indexerWsUrl?: string;
    proofServerUrl?: string;
    crawlerNodeUrl?: string;
    privateStateBackend?: PrivateStateBackend;
    sessionTtlMs?: number;
    corsOrigin?: string | string[];
    contentSecurityPolicy?: string | false | 'off';
    palletMap?: Record<string, {
        name: string;
        txType: string;
        isShielded?: boolean;
        isSystem?: boolean;
    }>;
    crawler?: {
        enabled?: boolean;
        nodeUrl?: string;
        fetchConcurrency?: number;
        rpcBatchSize?: number;
        requestTimeout?: number;
    };
    contracts?: Record<string, {
        artifactPath: string;
        privateStateId: string;
        zkConfigPath: string;
    }>;
    /**
     * Safety gate for mainnet. Default false: submission actions reject when
     * `network === 'mainnet'` unless this is explicitly true. Mainnet has known
     * submission instability (`1016 Immediately Dropped`, forum thread 1190), so
     * the gate is opt-in. Read-only indexing is unaffected.
     */
    allowMainnetSubmission?: boolean;
    /**
     * How an authenticated principal maps to the AttestationVault circuit's
     * `Bytes<32>` grantee id used to match on-chain disclosure grants at read
     * time (Phase 0 of expose-disclosure-grants). Default 'wallet'.
     *   - 'wallet': granteeId derived from the principal's coin public key.
     *   - 'did':    granteeId derived from a registered DID string.
     *   - 'custom': granteeId is an opaque 64-hex the consumer registers.
     * The SAME derivation must be used by whoever issues the grant — see
     * srv/submission/grantee-identity.ts.
     */
    granteeBinding?: GranteeBinding;
    [k: string]: unknown;
}
/**
 * Single-cast accessor for the plugin's CAP config block.
 *
 * `cds.env` is typed as a freeform object by CAP (it merges package.json,
 * .cdsrc, and env vars at runtime, so the shape is genuinely dynamic).
 * Rather than scattering `(cds.env as any).requires?.nightgate` across every
 * callsite — which we did before and got rightly called out for — the cast
 * lives ONCE here and every other site reads a properly typed
 * `NightgatePluginConfig` via this function.
 */
export declare function getNightgatePluginConfig(): NightgatePluginConfig;
export declare const DEFAULT_NETWORK: NightgateNetwork;
export declare const DEFAULT_NODE_URL = "wss://rpc.preprod.midnight.network/";
export declare const DEFAULT_INDEXER_URLS: Record<NightgateNetwork, {
    http: string;
    ws: string;
}>;
export declare const DEFAULT_PROOF_SERVER_URL = "http://localhost:6300";
export declare const DEFAULT_ZK_CONFIG_BASE = "./contracts";
export declare const VALID_PRIVATE_STATE_BACKENDS: readonly ["cap-db", "level"];
export type PrivateStateBackend = (typeof VALID_PRIVATE_STATE_BACKENDS)[number];
export declare const DEFAULT_PRIVATE_STATE_BACKEND: PrivateStateBackend;
export declare function getConfiguredPrivateStateBackend(config?: Record<string, any>): PrivateStateBackend;
export declare const VALID_GRANTEE_BINDINGS: readonly ["wallet", "did", "custom"];
export type GranteeBinding = (typeof VALID_GRANTEE_BINDINGS)[number];
export declare const DEFAULT_GRANTEE_BINDING: GranteeBinding;
export declare function getConfiguredGranteeBinding(config?: Record<string, any>): GranteeBinding;
export declare function getConfiguredNightgateNetwork(config?: Record<string, any>): string | undefined;
export declare function getConfiguredNightgateNodeUrl(config?: Record<string, any>): string | undefined;
export declare function getConfiguredNightgateCrawlerNodeUrl(config?: Record<string, any>): string | undefined;
export declare function isNightgatePluginConfigured(config?: Record<string, any>): boolean;
export declare function normalizeNightgateNetwork(network?: string): {
    network: NightgateNetwork;
    invalidNetwork?: string;
};
export interface SubmissionEndpointsConfig {
    indexerHttpUrl: string;
    indexerWsUrl: string;
    proofServerUrl: string;
    zkConfigBasePath: string;
}
export declare function resolveSubmissionEndpoints(network: NightgateNetwork, config?: Record<string, any>): SubmissionEndpointsConfig;
export declare function resolveNightgateRuntimeConfig(config?: Record<string, any>): {
    network: NightgateNetwork;
    nodeUrl: string;
    crawlerConfig: Record<string, unknown>;
    crawlerNodeUrl: string;
    submissionEndpoints: SubmissionEndpointsConfig;
    invalidNetwork?: string;
};
/**
 * Mainnet submission safety gate. Returns a human-readable rejection reason when
 * the resolved network is `mainnet` and `allowMainnetSubmission` is not explicitly
 * true; otherwise null (submission allowed). Used by every on-chain submission
 * action handler to fail fast before building/submitting a transaction.
 */
export declare function mainnetSubmissionBlockReason(config: NightgatePluginConfig): string | null;
