import { HashAlgorithm } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
import { IbGib_V1, IbGibData_V1, IbGibRel8ns_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
import { KEYSTONE_ATOM } from "./keystone-constants.mjs";
export declare const KEYSTONE_CHALLENGE_TYPE_HASH_REVEAL_V1 = "hash-reveal-v1";
/**
 * The discriminator for the mechanism.
 * 'hash-reveal-v1': Standard Hash chain (Sigma-like).
 */
export type KeystoneChallengeType = typeof KEYSTONE_CHALLENGE_TYPE_HASH_REVEAL_V1;
export declare const KeystoneChallengeType: {
    hash_reveal_v1: "hash-reveal-v1";
};
export declare const KEYSTONE_CHALLENGE_TYPE_VALID_VALUES: "hash-reveal-v1"[];
export declare function isValidKeystoneChallengeType(x: any): x is KeystoneChallengeType;
/**
 * @see {@link KeystoneReplenishStrategy.topUp}
 */
export declare const KEYSTONE_REPLENISH_STRATEGY_TOP_UP = "top-up";
/**
 * @see {@link KeystoneReplenishStrategy.replaceAll}
 */
export declare const KEYSTONE_REPLENISH_STRATEGY_REPLACE_ALL = "replace-all";
/**
 * @see {@link KeystoneReplenishStrategy.consume}
 */
export declare const KEYSTONE_REPLENISH_STRATEGY_CONSUME = "consume";
/**
 * @see {@link KeystoneReplenishStrategy.deleteAll}
 */
export declare const KEYSTONE_REPLENISH_STRATEGY_DELETE_ALL = "delete-all";
export type KeystoneReplenishStrategy = typeof KEYSTONE_REPLENISH_STRATEGY_TOP_UP | typeof KEYSTONE_REPLENISH_STRATEGY_REPLACE_ALL | typeof KEYSTONE_REPLENISH_STRATEGY_CONSUME | typeof KEYSTONE_REPLENISH_STRATEGY_DELETE_ALL;
/**
 * @see {@link KeystonePoolBehavior.replenish}
 */
export declare const KeystoneReplenishStrategy: {
    /**
     * replaces each used challenge, "topping up" the pool to the pool's size
     */
    topUp: "top-up";
    /**
     * replaces the entire pool with the new challenges
     */
    replaceAll: "replace-all";
    /**
     * do not replenish, only consume
     *
     * ## intent
     * adding this for revocation, though we have added deleteAll for this now.
     * Leaving it in.
     */
    consume: "consume";
    /**
     * Deletes ALL challenges in the pool, regardless of how many were used.
     * The "Nuclear Option" for revocation.
     */
    deleteAll: "delete-all";
};
export declare const KEYSTONE_REPLENISH_STRATEGY_VALID_VALUES: ("top-up" | "replace-all" | "consume" | "delete-all")[];
export declare function isKeystoneReplenishStrategy(x: any): x is KeystoneReplenishStrategy;
export interface KeystonePoolBehavior {
    /**
     * Target number of challenges to maintain in the pool.
     */
    size: number;
    /**
     * How do we fill the void left by consumed challenges?
     *
     * @see {@link KeystoneReplenishStrategy} individual members for information
     * on each one.
     */
    replenish: KeystoneReplenishStrategy;
    /**
     * Minimum number of challenges to consume from the "front" (oldest) of the pool.
     * Mitigates sequence prediction attacks if high, allows strictly ordered audit if used alone.
     */
    selectSequentially: number;
    /**
     * Minimum number of challenges to consume randomly from the remainder.
     * Mitigates pre-computation attacks on the sequence.
     */
    selectRandomly: number;
    /**
     * Number of challenges to draw deterministically from the pool using
     * next-gen hash-based index selection (drawing without replacement)
     * bound to the full target address (`ib` + `gib`).
     * @default 0
     */
    targetBindingCount: number;
}
export interface KeystonePoolConfigBase {
    /**
     * The ID of the pool this config belongs to.
     */
    id: string;
    type: KeystoneChallengeType;
    /**
     * Unique salt for this pool's derivation path from the Master Secret.
     */
    salt: string;
    behavior: KeystonePoolBehavior;
    /**
     * The list of Verbs (primitive ibGib addresses) this pool is authorized to sign.
     * e.g. ["revoke^gib", "admin^gib"]
     *
     * If undefined or empty, this pool is considered a "General/Default" pool
     * and can sign any verb NOT explicitly claimed by another pool (implementation detail of selection)
     * or simply any verb at all (permissive).
     *
     * For V1 Security: If this is set, Validation MUST enforce it.
     */
    allowedVerbs: string[];
}
export interface KeystonePoolConfig_HashV1 extends KeystonePoolConfigBase {
    type: typeof KeystoneChallengeType.hash_reveal_v1;
    algo: HashAlgorithm;
    rounds: number;
}
export type KeystonePoolConfig = KeystonePoolConfig_HashV1;
export interface KeystoneChallengeBase {
    type: KeystoneChallengeType;
}
export interface KeystoneChallenge_HashV1 extends KeystoneChallengeBase {
    id: string;
    type: typeof KeystoneChallengeType.hash_reveal_v1;
    /**
     * The hash that must be matched by the solution.
     */
    hash: string;
}
export type KeystoneChallenge = KeystoneChallenge_HashV1;
export interface KeystoneSolutionBase {
    type: KeystoneChallengeType;
    /**
     * The ID of the pool this solution comes from.
     */
    poolId: string;
    /**
     * The ID of the specific challenge being solved.
     */
    challengeId: string;
}
export interface KeystoneSolution_HashV1 extends KeystoneSolutionBase {
    type: 'hash-reveal-v1';
    /**
     * The Pre-image value.
     */
    value: string;
}
export type KeystoneSolution = KeystoneSolution_HashV1;
/**
 * A container for a set of challenges.
 */
export interface KeystoneChallengePool {
    /**
     * Unique ID (e.g. "default", "admin").
     */
    id: string;
    /**
     * Parameterization of this pool.
     *
     * Signing and validating this pool must observe this config.
     */
    config: KeystonePoolConfig;
    /**
     * Default claim values for this pool.
     * Useful for "verb-stones".
     */
    defaultClaim?: Partial<KeystoneClaim>;
    /**
     * The currently active challenges.
     * Key: The unique Challenge ID (e.g. "poolSalt_0").
     */
    challenges: {
        [challengeId: string]: KeystoneChallenge;
    };
    /**
     * If true, this pool's secrets are NOT derived from the Keystone's
     * primary Master Secret. They are held by an external entity.
     *
     * ## intent
     *
     * The driving use case for this is signing in with a server "super node"
     * and giving that node the ability to sign on behalf of the user. This is a
     * common pattern in SSO-type workflows.
     */
    isForeign?: boolean;
    /**
     * Arbitrary metadata for the wallet/user to identify the pool.
     * e.g. { delegate: "PrimaryServer", purpose: "SSO" }
     *
     * ## intent
     *
     * The driving use case for this is signing in with a server "super node"
     * and giving that node the ability to sign on behalf of the user. This is a
     * common pattern in SSO-type workflows.
     */
    metadata?: any;
}
export declare const KEYSTONE_CLAIM_TYPE_ADD_POOL = "add-pool";
export declare const KEYSTONE_CLAIM_TYPE_REMOVE_POOL = "remove-pool";
export declare const KEYSTONE_CLAIM_TYPE_REPLACE_POOL = "replace-pool";
export declare const KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD = "change-password";
export type KeystoneClaimType = typeof KEYSTONE_CLAIM_TYPE_ADD_POOL | typeof KEYSTONE_CLAIM_TYPE_REMOVE_POOL | typeof KEYSTONE_CLAIM_TYPE_REPLACE_POOL | typeof KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD;
export declare const KeystoneClaimType: {
    add_pool: "add-pool";
    remove_pool: "remove-pool";
    replace_pool: "replace-pool";
    change_password: "change-password";
};
export declare const KEYSTONE_CLAIM_TYPE_VALID_VALUES: KeystoneClaimType[];
export declare function isKeystoneClaimType(value: any): value is KeystoneClaimType;
export interface ClaimDetails {
    type: KeystoneClaimType;
    info: any;
}
export interface ClaimDetails_AddPool {
    add: string[];
}
export interface ClaimDetails_RemovePool {
    remove: string[];
}
export interface ClaimDetails_ReplacePool {
    replace: string;
}
export interface ClaimDetails_ChangePassword {
    change: string[];
}
/**
 * Describes the specific privilege that the evolution of the keystone
 * authorizes.
 */
export interface KeystoneClaim {
    /**
     * what action/ability does the claim make?
     *
     * @see {@link KeystoneVerb} and all of its members for just a list of some
     * common verbs. But really, this can be any string.
     */
    verb: string;
    /**
     * What specific ibgib does this claim relate to?
     *
     * For example, if we are signing a keystone to witness some specific ibgib
     * itself, similar to the most conventional use of digital signatures, then
     * this will be the address of that ibgib.
     */
    target: IbGibAddr;
    /**
     * Detailed information describing the nature of the keystone evolution/transition.
     */
    details?: ClaimDetails;
}
/**
 * Authorization Proof.
 */
export interface KeystoneProof {
    id?: string;
    /**
     * The claim being made.
     */
    claim: Partial<KeystoneClaim>;
    /**
     * The solutions required to validate this claim.
     */
    solutions: KeystoneSolution[];
    /**
     * The list of specific Challenge IDs that were mandatorily requested
     * by the verifier/context during the signing process.
     * Essential for deterministic validation.
     */
    requiredChallengeIds?: string[];
}
/**
 * Revocation Context.
 */
export interface KeystoneRevocationInfo {
    reason: string;
    proof: KeystoneProof;
}
/**
 * Shape of info we collect about delegated keystones. We can check
 * against this info later when validating any identity delegation requests.
 */
export interface DelegateKeystoneInfo {
    /**
     * The Timeline Junction Point (TJP) address of the delegate keystone.
     * Serves as its immutable, unique identifier.
     */
    delegateTjpAddr: IbGibAddr;
    /**
     * concrete addr of **DELEGATE** keystone **at the time when the
     * delegate was added.**
     *
     * So if we have a delegate keystone at D3, then this value would be the
     * addr of that D3 keystone. This will have both a `punctiliarHash` and a
     * `tjpGib` in its `GibInfo`.
     */
    delegateAddr: IbGibAddr;
    /**
     * concrete keystone addr of **THIS** parent keystone **at the time
     * when the delegate was added.**
     *
     * So if we have a delegate keystone at D3, then this value would be the
     * addr of that D3 keystone. This will have both a `punctiliarHash` and a
     * `tjpGib` in its `GibInfo`.
     */
    thisAddr: IbGibAddr;
    /**
     * Optional list of verbs allowed for this delegate.
     * e.g. ["sync^gib"]
     */
    allowedVerbs?: string[];
}
/**
 * Status response when checking if a delegate keystone is registered.
 */
export interface DelegateKeystoneStatus {
    /**
     * True if the delegate is currently registered on the parent.
     */
    registered: boolean;
    /**
     * Truthy only if registered is true.
     */
    delegateInfo?: DelegateKeystoneInfo;
}
export interface KeystoneIb_V1 {
    atom: typeof KEYSTONE_ATOM;
}
export interface KeystoneData_V1 extends IbGibData_V1 {
    /**
     * The pools containing the FUTURE challenges.
     * (Always topped up in V1 implementation).
     */
    challengePools: KeystoneChallengePool[];
    /**
     * The proofs authorizing THIS frame's evolution.
     */
    proofs: KeystoneProof[];
    /**
     * If present, this Keystone is dead.
     */
    revocationInfo?: KeystoneRevocationInfo;
    /**
     * Ephemeral details specific to this frame's creation context.
     * Meant to be observed on this frame, but NOT automatically carried forward
     * to the next frame's data during evolution.
     */
    frameDetails?: any;
    /**
     * Aggregated state of the Keystone identity up to this frame.
     * Acts as a snapshot to avoid walking the entire timeline.
     */
    checkpointDetails?: any;
    /**
     * Map of delegated keystones soft-linked to this parent keystone.
     * Keyed by the delegate keystone's tjp address.
     */
    delegates?: {
        [delegateTjpAddr: IbGibAddr]: DelegateKeystoneInfo;
    };
}
export interface KeystoneRel8ns_V1 extends IbGibRel8ns_V1 {
}
export interface KeystoneIbGib_V1 extends IbGib_V1<KeystoneData_V1, KeystoneRel8ns_V1> {
    data: KeystoneData_V1;
    rel8ns: KeystoneRel8ns_V1;
}
export interface DeterministicResult {
    /**
     * The Set of IDs that MUST be present in the solution.
     * Includes Alice's Demands + Target Binding Matches + FIFO.
     */
    mandatoryIds: Set<string>;
    /**
     * The IDs remaining in the pool that are valid candidates for
     * the Random/Stochastic step.
     */
    availableIds: string[];
}
//# sourceMappingURL=keystone-types.d.mts.map