/**
 * ReceiptQueue — tamper-evident in-memory queue for TSA receipt retries.
 *
 * CH1-r: Every entry is HMAC-SHA-256 authenticated. process() rejects entries
 * with invalid HMACs before submitting to the TSA — no silent data corruption.
 *
 * Backoff schedule: DEFAULT_BACKOFF_MS defines 5 exponential windows.
 * process() skips entries whose next retry time has not been reached yet
 * (based on queuedAt + DEFAULT_BACKOFF_MS[attempts - 1]).
 *
 * KeyProvider isolation: the key is fetched from the provider at enqueue and
 * process time — never stored in the entry itself.
 *
 * @module proof/receipt-queue
 */
import type { KeyProvider } from "../ports/key-provider.js";
import type { TimestampPort } from "../ports/timestamp.js";
export interface ReceiptQueueEntry {
    runId: string;
    rootHash: string;
    /** Unix epoch milliseconds when this entry was first enqueued. */
    queuedAt: number;
    /** Number of prior failed attempts (0 on first enqueue). */
    attempts: number;
    /**
     * HMAC-SHA-256(canonical(entry-without-hmac), key from provider).
     * CH1-r: tamper-evident field. process() rejects if this does not
     * match a freshly computed HMAC.
     */
    hmac: string;
}
export interface ReceiptQueue {
    /**
     * Add a new entry to the queue. Computes and stores the HMAC.
     *
     * @param entry       - Entry without hmac/attempts.
     * @param keyProvider - Provider that supplies the HMAC key.
     * @param keyId       - Key identifier for keyProvider.getKey().
     */
    enqueue(entry: Omit<ReceiptQueueEntry, "hmac" | "attempts">, keyProvider: KeyProvider, keyId: string): Promise<void>;
    /** Return all entries currently in the queue (including those in backoff). */
    pending(): Promise<ReceiptQueueEntry[]>;
    /**
     * Process up to `batchSize` due entries.
     *
     * For each entry:
     *   - Recompute HMAC; if mismatch → increment `rejected`, do NOT call adapter.
     *   - If backoff window not elapsed → skip (not counted in any bucket).
     *   - On success → remove from queue.
     *   - On failure → increment `entry.attempts`, apply next backoff.
     *
     * @returns { processed, failed, rejected }
     */
    process(adapter: TimestampPort, keyProvider: KeyProvider, keyId: string, opts?: {
        batchSize?: number;
        backoffMs?: readonly number[];
    }): Promise<{
        processed: number;
        failed: number;
        rejected: number;
    }>;
    /** Number of entries currently in the queue. Test helper. */
    size?(): Promise<number>;
}
/**
 * Default exponential backoff schedule (5 levels).
 * Level 0 = 30s, 1 = 5min, 2 = 1h, 3 = 6h, 4 = 24h.
 */
export declare const DEFAULT_BACKOFF_MS: readonly [30000, number, number, number, number];
/**
 * Thrown internally when a queue entry HMAC fails verification.
 * The error is caught by process() and counted in the `rejected` bucket.
 */
export declare class HmacInvalidError extends Error {
    constructor(runId: string);
}
/**
 * In-memory ReceiptQueue implementation.
 *
 * Not durable across restarts — for production persistence, implement
 * ReceiptQueue against a PostgreSQL table (see sprint-562 B2).
 */
export declare class InMemoryReceiptQueue implements ReceiptQueue {
    private readonly _entries;
    enqueue(entry: Omit<ReceiptQueueEntry, "hmac" | "attempts">, keyProvider: KeyProvider, keyId: string): Promise<void>;
    pending(): Promise<ReceiptQueueEntry[]>;
    process(adapter: TimestampPort, keyProvider: KeyProvider, keyId: string, opts?: {
        batchSize?: number;
        backoffMs?: readonly number[];
    }): Promise<{
        processed: number;
        failed: number;
        rejected: number;
    }>;
    size(): Promise<number>;
}
//# sourceMappingURL=receipt-queue.d.ts.map