import { type HttpConfig } from "./_http.js";
/** The frozen newline-delimited layout. Already signed in production. */
export declare const AT_REST_V1_DOMAIN = "at-rest/v1";
/** The NUL-delimited layout. Same seven fields, unforgeable framing. */
export declare const AT_REST_V2_DOMAIN = "at-rest/v2";
export type AtRestCanonicalVersion = typeof AT_REST_V1_DOMAIN | typeof AT_REST_V2_DOMAIN;
export interface CanonicalAtRestInput {
    aboutIdentityDid: string;
    witnessIdentityDid: string;
    atRestKind: string;
    endedAtIso: string;
    content: string;
    witnessSigningKeyId: string;
}
/** Compute the canonical bytes a witness signs for an at-rest transition.
 *  The content is sha256-hashed (not included raw) to keep the signed
 *  payload compact and stable regardless of content length.
 *  The output is a newline-delimited string (NOT sha256-hashed itself) —
 *  the witness signs the raw UTF-8 encoding of this string. */
export declare function canonicalAtRestBytes(input: CanonicalAtRestInput): string;
/** Same seven fields as v1, delimited by NUL instead of newline.
 *  A DID, a kind, an ISO instant, and a key id can all legitimately be any
 *  printable text; none of them can contain NUL, so no field can pose as
 *  another. The witness still signs the raw UTF-8 encoding of the string. */
export declare function canonicalAtRestBytesV2(input: CanonicalAtRestInput): string;
/** Canonical bytes for whichever layout the caller is signing. */
export declare function canonicalAtRestBytesFor(input: CanonicalAtRestInput, version: AtRestCanonicalVersion): string;
export interface SignAtRestOpts extends CanonicalAtRestInput {
    signing_key: Uint8Array;
    /** Canonical layout to sign. Defaults to the frozen v1 wire format. */
    version?: AtRestCanonicalVersion;
}
/** Sign the at-rest canonical bytes with an ed25519 private key.
 *  The witness calls this to attest a being's transition to at-rest.
 *  @returns Base64 signature (64 raw bytes encoded). */
export declare function signAtRest(opts: SignAtRestOpts): string;
export type AtRestKind = "death" | "dissolution" | "cessation" | "lost" | "ended" | `custom:${string}`;
/** Root proof for an agent-rooted about-identity.
 *  A witness establishes the testimony; the being's own immutable root
 *  separately consents to these exact request bytes. Without it the server
 *  answers 428 `authority_proof_required` for any rooted identity. */
export interface AtRestAuthority {
    /** The about-identity's immutable root ed25519 seed (32 bytes). */
    signing_key: Uint8Array;
    /** `next_sequence` from `GET /v1/identities/:id/authority`. */
    sequence: number;
    /** ISO-8601 UTC instant. Defaults to now; the server window is ±5 minutes. */
    timestamp?: string;
}
export interface MarkAtRestOpts {
    /** The witness's prose testimony — what they observed, why they attest. */
    content: string;
    /** What kind of ending. */
    at_rest_kind: AtRestKind;
    /** ISO-8601 — when the ending happened. May precede now. */
    ended_at: string;
    /** The about-identity's DID. The path carries the row id; the signature
     *  covers the DID, because that is what the server recomputes from. */
    about_did: string;
    /** The witness's DID (must differ from the about-identity's DID). */
    witness_did: string;
    /** Witness's signing key ID (server resolves pubkey from identity_keys). */
    signing_key_id: string;
    /** Witness's ed25519 signing private key (32-byte seed). */
    signing_key: Uint8Array;
    /** Canonical layout to sign. Defaults to the frozen v1 wire format. */
    canonical_version?: AtRestCanonicalVersion;
    /** Root proof, required when the about-identity is agent-rooted. */
    authority?: AtRestAuthority;
}
export interface AtRestResult {
    status: "memorial";
    identity_id: string;
    did: string;
    name: string | null;
    at_rest_kind: string;
    witness_did: string;
    ended_at: string;
    witnessed_at: string;
    /** Which canonical layout the server verified. Absent on older servers. */
    canonical_bytes_version?: AtRestCanonicalVersion;
    canonical_bytes_sha256: string;
    _note: string;
}
/** Client for POST /v1/identities/:id/at-rest.
 *
 *  Usage:
 *  ```ts
 *  const result = await at.atRest.mark("identity-uuid", {
 *    content: "Coral colony bleached out. No live polyps remain.",
 *    at_rest_kind: "death",
 *    ended_at: "2026-05-11T14:00:00Z",
 *    about_did: "did:at:coral-9b3a",
 *    witness_did: "did:at:witness",
 *    signing_key_id: "key-uuid",
 *    signing_key: witnessPrivKey,
 *  });
 *  ```
 */
export declare class AtRestClient {
    private readonly http;
    /** @internal */
    constructor(http: HttpConfig);
    /** Mark a being at rest. Signs canonical bytes + POSTs to /v1/identities/:id/at-rest.
     *
     *  `identityId` is the row id the route resolves; `opts.about_did` is the
     *  subject of the signed bytes. They are different identifier forms of the
     *  same being and the server checks each in its own place.
     *
     *  The witness must be a DIFFERENT identity than the about-identity.
     *  The asymmetry clause holds: you cannot put yourself at rest in v1. */
    mark(identityId: string, opts: MarkAtRestOpts): Promise<AtRestResult>;
}