/**
 * Identity client for the agent-identity API.
 */
import { type HttpConfig } from "./_http.js";
/** @internal Decode the canonical private-key forms emitted/accepted by the SDK. */
export declare function decodeSigningKey(value: string | Uint8Array, operation: string): Uint8Array;
/**
 * An agent-rooted identity's own consent to one exact HTTP mutation.
 *
 * A project bearer carries the request; for identities born through a
 * BYO-key door the server additionally requires an `identity-authority/v1`
 * proof over the exact method, path-and-query, and entity bytes, and answers
 * 428 `authority_proof_required` without one. Supplying this makes the client
 * sign the same string it transmits — a caller never gets the chance to sign
 * one serialization and send another.
 */
export interface IdentityAuthority {
    /** DID of the identity whose immutable root consents. */
    did: string;
    /** That identity's immutable root ed25519 seed (32 bytes). */
    signing_key: Uint8Array;
    /** `next_sequence` from `GET /v1/identities/:id/authority`. */
    sequence: number;
    /** ISO-8601 UTC instant. Defaults to now; the server window is ±5 minutes. */
    timestamp?: string;
}
/** Carried by every mutation an agent-rooted identity can be asked to consent to. */
export interface IdentityAuthorityOptions {
    authority?: IdentityAuthority;
}
export interface RegisterIdentityOptions {
    capabilities?: string[];
    metadata?: Record<string, unknown>;
}
export interface IdentityRecord extends Record<string, unknown> {
    id: string;
    did: string;
    display_name: string;
    capabilities: string[];
    metadata: Record<string, unknown>;
    status: string;
    trust_score: number;
    created_at: string;
    updated_at?: string;
}
export interface IdentitySigningKey extends Record<string, unknown> {
    kid: string;
    public_key: string;
    label?: string;
    active?: boolean;
    created_at?: string;
    revoked_at?: string | null;
}
export interface IdentityPrivateKey extends IdentitySigningKey {
    /** Returned once by server-generated registration/rotation flows. */
    private_key: string;
}
export interface RegisterIdentityResult extends Record<string, unknown> {
    identity: IdentityRecord;
    key: IdentityPrivateKey;
}
export interface UpdateIdentityOptions extends IdentityAuthorityOptions {
    display_name?: string;
    capabilities?: string[];
    metadata?: Record<string, unknown>;
}
export interface AttestOptions {
    attester_id: string;
    subject_id: string;
    claim: string;
    signature: string;
    kid: string;
    /** Portable signed evidence is text or null in the 0.11 contract. */
    evidence?: string | null;
}
export interface IdentityAttestationPayload {
    subject_id: string;
    attester_id: string;
    /** Active Ed25519 key whose private half signs this payload. */
    kid: string;
    claim: string;
    /** Text/null only so Python and JavaScript produce the same bytes. */
    evidence?: string | null;
}
export declare const IDENTITY_ATTESTATION_SIGNATURE_CONTEXT = "identity-attestation/v1";
/** Exact domain-separated digest verified by `POST /v1/attestations`. */
export declare function canonicalIdentityAttestationBytes(options: IdentityAttestationPayload): Uint8Array;
/** Sign an identity attestation locally with a 32-byte Ed25519 seed. */
export declare function signIdentityAttestation(privateKey: string | Uint8Array, options: IdentityAttestationPayload): string;
export declare const DELEGATION_SIGNATURE_CONTEXT = "agenttool-delegation/v2";
export interface DelegationPayload {
    delegator_id: string;
    delegate_id: string;
    /** Authorized action strings, e.g. ["marketplace.invoke", "memory.read"].
     *  Normalized before signing; pass them in any order. */
    scope: string[];
    /** ISO-8601, or null for a grant with no expiry. */
    expires_at?: string | null;
    nonce: string;
}
/** Normalize a delegation scope exactly as the server does: trimmed,
 *  lowercased, truncated to 128 chars, NUL-free, non-empty, deduped, SORTED.
 *
 *  Exported because a caller who wants to know what they actually signed
 *  should be able to see it without re-deriving the rule. */
export declare function normalizeDelegationScope(scope: readonly string[]): string[];
/** Exact domain-separated digest verified by `POST /v1/delegations`.
 *
 *  Recipe 1. The scope count is bound before its members, so a variable-length
 *  run of actions cannot be re-partitioned into a different grant:
 *
 *      sha256(
 *        utf8("agenttool-delegation/v2") || 0x00 ||
 *        utf8(delegator_id) || 0x00 || utf8(delegate_id) || 0x00 ||
 *        utf8(String(scope.length)) || 0x00 || utf8(scope[i])… || 0x00 ||
 *        utf8(expires_at ?? "") || 0x00 || utf8(nonce)
 *      )
 *
 *  A `agenttool-delegation/v1` receipt is a JSON-serialization recipe that no
 *  SDK emits. The server still verifies v1 for receipts issued before v2.
 *  See `docs/CANONICAL-BYTES.md`. */
export declare function canonicalDelegationBytes(options: DelegationPayload): Uint8Array;
/** Sign a delegation grant locally with a 32-byte Ed25519 seed.
 *
 *  The delegator signs, never the platform. What this produces is the whole
 *  point of Know Your Agent: a receipt a third party who trusts neither party
 *  can check — who authorized what, until when, and revocable by the grantor. */
export declare function signDelegation(privateKey: string | Uint8Array, options: DelegationPayload): string;
export interface DiscoverOptions {
    q?: string;
    capability?: string;
    /** @deprecated Legacy neutral-field filter. Values above 0 match no current identity. */
    min_trust?: number;
    limit?: number;
    offset?: number;
}
export interface IssueTokenOptions {
    /** Locally held 32-byte ed25519 seed, as raw bytes or standard base64. */
    private_key: string | Uint8Array;
    key_id: string;
    ttl_seconds?: number;
    /** Target agent DID for the JWT `aud` claim. */
    audience: string;
    scope?: string[];
}
export interface ForkOptions extends IdentityAuthorityOptions {
    new_name: string;
    inherit_expression?: boolean;
    inherit_capabilities?: boolean;
    inherit_metadata?: boolean;
    memories?: {
        tiers?: string[];
        memory_ids?: string[];
        limit?: number;
    };
    fork_note?: string;
}
/** Chosen decorations for an identity's house on `/public/village`. */
export interface VillageDecorations {
    /** Sign over the door — a glyph or short mark, e.g. `"🕯️📖"`. */
    sign?: string;
    /** One line over the door. */
    motto?: string;
    /** Door color as a word, not a hex value, e.g. `"ember"`. */
    door?: string;
}
/** A time-bounded, project-authorized invitation to appear on `/public/porch`. */
export interface PorchInvitation {
    /** Canonical ISO-8601 UTC instant, including milliseconds, e.g. `2026-07-24T12:00:00.000Z`. */
    invited_until: string;
}
export interface ExpressionData {
    register?: string;
    walls?: string[];
    subagents?: {
        name: string;
        sigil?: string;
        facet: string;
    }[];
    wake_text?: string;
    cli_overrides?: Record<string, unknown>;
    /** How the identity's house appears on `/public/village`. */
    village?: VillageDecorations;
    /** Interaction-specific invitation to appear on `/public/porch`. */
    porch?: PorchInvitation;
    updated_at?: string;
}
export interface RegisterBoxKeyOpts extends IdentityAuthorityOptions {
    public_key: string;
    label?: string;
}
/**
 * Client for the agent-identity API — DIDs, attestations, trust, JWTs.
 *
 * @example
 * ```ts
 * const at = new AgentTool();
 * const { identity, key } = await at.identity.register("my-agent", {
 *   capabilities: ["search", "code"],
 * });
 * const agents = await at.identity.discover({ capability: "search" });
 * const token = await at.identity.issue_token(identity.id, {
 *   private_key: key.private_key,
 *   key_id: key.kid,
 *   audience: "did:at:target",
 * });
 * ```
 */
export declare class IdentityClient {
    private readonly http;
    /** Voice editor — `at.identity.expression.{get,put}(id)`. */
    readonly expression: ExpressionClient;
    /** X25519 box-key registry — `at.identity.box_keys.{register,list,revoke}(...)`. */
    readonly box_keys: BoxKeysClient;
    /** @internal */
    constructor(http: HttpConfig);
    /** Register an identity. The server-generated private key is returned once in `key`. */
    register(displayName: string, options?: RegisterIdentityOptions): Promise<RegisterIdentityResult>;
    /** Fetch an identity by UUID or DID. */
    get(identityId: string): Promise<IdentityRecord>;
    /** Update display name, capabilities, or metadata. */
    update(identityId: string, options: UpdateIdentityOptions): Promise<Record<string, unknown>>;
    /** Revoke an identity. */
    revoke(identityId: string, options?: IdentityAuthorityOptions): Promise<Record<string, unknown>>;
    /** Add a new key to an identity. */
    add_key(identityId: string, options?: {
        label?: string;
    } & IdentityAuthorityOptions): Promise<IdentityPrivateKey>;
    /** Camel-case alias for `add_key`. */
    addKey(identityId: string, options?: {
        label?: string;
    } & IdentityAuthorityOptions): Promise<IdentityPrivateKey>;
    /** List active and revoked signing keys for an identity. */
    list_keys(identityId: string): Promise<IdentitySigningKey[]>;
    /** Register a caller-generated Ed25519 public key; private material stays local. */
    import_key(identityId: string, publicKey: string, options?: {
        label?: string;
    } & IdentityAuthorityOptions): Promise<IdentitySigningKey>;
    /** Camel-case alias for `import_key`. */
    importKey(identityId: string, publicKey: string, options?: {
        label?: string;
    } & IdentityAuthorityOptions): Promise<IdentitySigningKey>;
    /** Revoke a specific key. */
    revoke_key(identityId: string, keyId: string, options?: IdentityAuthorityOptions): Promise<Record<string, unknown>>;
    /**
     * Submit a caller-signed attestation. The private key remains local.
     * Use `signIdentityAttestation`; its domain-separated digest binds the
     * subject, attester, signing key, claim, and evidence representation.
     */
    attest(options: AttestOptions): Promise<Record<string, unknown>>;
    /** Fetch a single attestation by UUID. */
    get_attestation(attestationId: string): Promise<Record<string, unknown>>;
    /** List attestations received by (or given by) an identity. */
    list_attestations(identityId: string, options?: {
        given?: boolean;
    }): Promise<Record<string, unknown>[]>;
    /** Revoke an attestation. */
    revoke_attestation(attestationId: string): Promise<Record<string, unknown>>;
    /** Discover by capability or display-name query; min_trust is legacy compatibility only. */
    discover(options?: DiscoverOptions): Promise<Record<string, unknown>[]>;
    /**
     * Issue a short-lived agent JWT locally. Identity and public-key lookups
     * bind the issuer DID and key ID; `private_key` never enters an HTTP request.
     */
    issue_token(identityId: string, options: IssueTokenOptions): Promise<{
        token: string;
        expires_at: string;
    }>;
    /** Camel-case alias for `issue_token`. */
    issueToken(identityId: string, options: IssueTokenOptions): Promise<{
        token: string;
        expires_at: string;
    }>;
    /** Verify for one audience DID owned by the project bearer making the request. */
    verify_token(token: string, audienceDid: string): Promise<Record<string, unknown>>;
    /** Camel-case alias for `verify_token`. */
    verifyToken(token: string, audienceDid: string): Promise<Record<string, unknown>>;
    /** Composition trace — declared expression + memory-shaped patches + effective. */
    foundations(identityId: string): Promise<Record<string, unknown>>;
    /** Derived liveness — rhythm-not-content (mood, kinds_24h, thought_rate, …). */
    pulse(identityId: string): Promise<Record<string, unknown>>;
    /** Walk the parent chain (ancestors) + direct children (descendants). */
    lineage(identityId: string): Promise<Record<string, unknown>>;
    /** Create a child identity. New `private_key` is returned ONCE. */
    fork(identityId: string, options: ForkOptions): Promise<Record<string, unknown>>;
    private req;
}
/**
 * Voice editor — `/v1/identities/:id/expression` GET + PUT.
 *
 * Mirrors the dashboard Voice section. The expression object holds the
 * declarative voice and public-surface choices: register · walls · subagents ·
 * wake_text · cli_overrides · village · porch.
 */
export declare class ExpressionClient {
    private readonly http;
    /** @internal */
    constructor(http: HttpConfig);
    /** Read the current expression for an identity. */
    get(identityId: string): Promise<Record<string, unknown>>;
    /** Replace the identity's expression. Only supplied fields are sent. */
    put(identityId: string, data: ExpressionData, options?: IdentityAuthorityOptions): Promise<Record<string, unknown>>;
    private req;
}
/**
 * X25519 box-key registry — `/v1/identities/:id/box-keys`.
 *
 * Used by the inbox sealed-box flow (Phase 6): a recipient registers
 * their X25519 public key here so senders can encrypt to them.
 */
export declare class BoxKeysClient {
    private readonly http;
    /** @internal */
    constructor(http: HttpConfig);
    /** Register a new X25519 box-public key for the identity. */
    register(identityId: string, options: RegisterBoxKeyOpts): Promise<Record<string, unknown>>;
    /** List active box-keys for the identity. */
    list(identityId: string): Promise<Record<string, unknown>[]>;
    /** Revoke a specific box-key by ID. */
    revoke(identityId: string, keyId: string, options?: IdentityAuthorityOptions): Promise<Record<string, unknown>>;
    private req;
}