import type { Proof, Decision, Intent, ID } from '../common/types.js';
/**
 * Proof creation request
 */
export interface ProofRequest {
    intent: Intent;
    decision: Decision;
    inputs: Record<string, unknown>;
    outputs: Record<string, unknown>;
    /** Tenant ID for scoped locking (REQUIRED for multi-tenant isolation) */
    tenantId: string;
}
/**
 * Proof verification result
 */
export interface VerificationResult {
    valid: boolean;
    proofId: ID;
    chainPosition: number;
    issues: string[];
    verifiedAt: string;
}
/**
 * Proof query options
 */
export interface ProofQuery {
    entityId?: ID;
    intentId?: ID;
    startDate?: string;
    endDate?: string;
    limit?: number;
    offset?: number;
}
/**
 * Extended proof with signature metadata
 */
export interface SignedProof extends Proof {
    signatureData?: {
        publicKey: string;
        algorithm: string;
        signedAt: string;
    };
}
/**
 * Chain statistics
 */
export interface ChainStats {
    totalProofs: number;
    chainLength: number;
    lastProofAt: string | null;
}
/**
 * Chain verification options for paginated verification
 */
export interface ChainVerificationOptions {
    /** Number of proofs to verify per batch (default: 100) */
    batchSize?: number;
    /** Callback for progress updates */
    onProgress?: (verified: number, total: number) => void;
}
/**
 * Chain verification result with streaming support
 */
export interface ChainVerificationResult {
    valid: boolean;
    lastValidPosition: number;
    issues: string[];
    totalVerified: number;
}
/**
 * Signing algorithm for proof records
 */
export type ProofSigningAlgorithm = 'ed25519' | 'ecdsa-p256' | 'hybrid-ed25519-dilithium3';
/**
 * PROOF service for evidence management with PostgreSQL persistence
 *
 * CRITICAL FIX (PA-C1/PA-C2/DS-C1): This service now uses:
 * 1. Redis distributed locks to serialize proof creation across instances
 * 2. PostgreSQL row-level locking (SELECT FOR UPDATE) for chain state
 * 3. All state updates happen inside the transaction
 *
 * This prevents hash chain corruption in multi-instance deployments.
 */
export declare class ProofService {
    private db;
    private lockService;
    private chainId;
    private initialized;
    private signingAlgorithm;
    /**
     * Configure the signing algorithm for proof records.
     *
     * - 'ed25519' (default): Classical Ed25519 via WebCrypto
     * - 'ecdsa-p256': Classical ECDSA P-256 via WebCrypto
     * - 'hybrid-ed25519-dilithium3': Ed25519 + post-quantum Dilithium3 (ML-DSA-65)
     */
    setSigningAlgorithm(algorithm: ProofSigningAlgorithm): void;
    /**
     * Initialize the service - ensures database and lock service are ready
     *
     * NOTE: Chain state (lastHash, chainLength) is NO LONGER cached in memory.
     * It is always read from the database inside a transaction to prevent
     * race conditions in multi-instance deployments.
     */
    initialize(): Promise<void>;
    /**
     * Ensure service is initialized
     */
    private ensureInitialized;
    /**
     * Create a new proof record with cryptographic signature
     *
     * CRITICAL FIX (PA-C1/PA-C2/DS-C1): This method now uses:
     * 1. Redis distributed lock to serialize across multiple service instances
     * 2. PostgreSQL SELECT FOR UPDATE to lock the chain metadata row
     * 3. All state reads and writes happen inside the transaction
     *
     * SECURITY FIX: Uses per-tenant lock keys to prevent cross-tenant DoS attacks.
     * Each tenant has their own lock scope, so heavy proof creation by one tenant
     * cannot block proof creation for other tenants.
     *
     * This ensures hash chain integrity in multi-instance deployments.
     */
    create(request: ProofRequest): Promise<SignedProof>;
    /**
     * Internal method to create proof with database row locking
     * Called only after distributed lock is acquired
     */
    private createProofWithLock;
    /**
     * Get a proof by ID
     */
    get(id: ID): Promise<SignedProof | undefined>;
    /**
     * Query proofs
     */
    query(query: ProofQuery): Promise<SignedProof[]>;
    /**
     * Verify a proof's integrity (hash, chain linkage, and signature)
     */
    verify(id: ID): Promise<VerificationResult>;
    /**
     * Verify the entire chain integrity using streaming pagination
     *
     * Instead of loading all proofs into memory at once, this method
     * processes proofs in batches to handle large chains efficiently.
     *
     * @param options - Verification options including batch size and progress callback
     * @returns Chain verification result
     */
    verifyChain(options?: ChainVerificationOptions): Promise<ChainVerificationResult>;
    /**
     * Calculate hash for a proof record using canonical JSON
     *
     * IMPORTANT: Uses canonical JSON serialization to ensure deterministic
     * hash calculation across different environments. Standard JSON.stringify
     * does NOT guarantee key order, which can cause hash mismatches.
     */
    private calculateHash;
    /**
     * Convert database row to SignedProof
     */
    private toSignedProof;
    /**
     * Get chain statistics
     *
     * NOTE: Chain stats are now always read from the database to ensure
     * accuracy in multi-instance deployments.
     */
    getStats(): Promise<ChainStats>;
    /**
     * Get the current chain position (for testing/debugging)
     * Reads directly from database to ensure accuracy.
     */
    getChainPosition(): Promise<{
        lastHash: string;
        chainLength: number;
    }>;
}
/**
 * Create a new PROOF service instance
 */
export declare function createProofService(): ProofService;
export * from './merkle.js';
export { getMerkleService, MerkleService, type MerkleRootInfo } from './merkle-service.js';
export { initializeHybridSigning, signHybrid, verifyHybrid, isHybridAlgorithm, type HybridSignatureResult, type HybridVerifyResult, } from './hybrid-signing.js';
//# sourceMappingURL=index.d.ts.map