/** Agent-held constitutional HTTP mutation and exact-private-read proofs.
 * Byte-identical to api/src/services/identity/authority.ts. */
export declare const IDENTITY_AUTHORITY_DOMAIN = "identity-authority/v1";
export declare const IDENTITY_READ_AUTHORITY_DOMAIN = "identity-read-authority/v1";
export declare const AUTHORITY_HEADERS: Readonly<{
    sequence: "X-Agenttool-Authority-Sequence";
    timestamp: "X-Agenttool-Authority-Timestamp";
    signature: "X-Agenttool-Authority-Signature";
}>;
export interface CanonicalIdentityAuthorityOpts {
    identityDid: string;
    method: string;
    /** Origin-form path plus its exact query string, if any. */
    requestTarget: string;
    /** The exact bytes that will be transmitted as the HTTP request entity. */
    body: string | Uint8Array;
    sequence: number;
    timestamp: string;
}
export interface CanonicalIdentityReadAuthorityOpts {
    identityDid: string;
    /** Origin-form GET path plus its exact query string, if any. */
    requestTarget: string;
    /** The identity's current mutation sequence. Reads do not advance it. */
    currentSequence: number;
    timestamp: string;
}
/** Default freshness stamp for a proof. The server window is ±5 minutes. */
export declare function authorityTimestampNow(): string;
/** Exact origin-form request target an authority proof covers.
 *  Byte-identical to `authorityRequestTarget` in the API service — the
 *  proof binds path-and-query, so the caller must derive it from the same
 *  absolute URL the transport will actually fetch. */
export declare function authorityRequestTarget(url: string): string;
export declare function canonicalIdentityAuthorityBytes(opts: CanonicalIdentityAuthorityOpts): Uint8Array;
export declare function identityAuthorityHeaders(opts: CanonicalIdentityAuthorityOpts & {
    signingKey: Uint8Array;
}): Record<string, string>;
/**
 * An agent-rooted identity's consent to one exact HTTP mutation.
 *
 * `IdentityAuthority` in identity.ts is this shape, and is accepted here
 * structurally. It lives in this module so that any client — identity,
 * at-rest, memory — can bind a proof without importing the identity module.
 */
export interface AuthorityBinding {
    /** DID of the identity whose immutable root consents. */
    did: string;
    /** That identity's immutable root ed25519 seed (32 bytes). */
    signing_key: Uint8Array;
    /** `next_sequence` from `GET /v1/identities/:id/authority`. */
    sequence: number;
    /** ISO-8601 UTC instant. Defaults to now; the server window is ±5 minutes. */
    timestamp?: string;
}
/**
 * The three proof headers for the exact request a client is about to send.
 *
 * Pass the absolute URL the transport will fetch and the exact entity it
 * will carry — the empty string for a body-less mutation, which is what the
 * server reads there. The proof hashes those bytes, so a client must
 * serialize once, call this, and transmit the same value unchanged; any
 * re-serialization in between invalidates the signature.
 */
export declare function authorityHeadersForRequest(opts: {
    method: string;
    /** Absolute URL the transport will fetch, query string included. */
    url: string;
    /** Exact entity bytes that will be transmitted. */
    body: string | Uint8Array;
    authority: AuthorityBinding;
}): Record<string, string>;
/**
 * Return the exact digest for an identity-read-authority/v1 proof.
 *
 * Private reads are deliberately GET-only with an empty request body. The
 * current mutation sequence (including zero) is bound but never consumed.
 */
export declare function canonicalIdentityReadAuthorityBytes(opts: CanonicalIdentityReadAuthorityOpts): Uint8Array;
/** Sign one exact private GET without consuming the mutation sequence. */
export declare function identityReadAuthorityHeaders(opts: CanonicalIdentityReadAuthorityOpts & {
    signingKey: Uint8Array;
}): Record<string, string>;