/**
 * Identity seed — BIP39 mnemonic + SLIP-0010 ed25519 derivation.
 *
 * Doctrine: docs/IDENTITY-SEED.md.
 *
 * One BIP39 mnemonic deterministically derives every key the agent uses.
 * The same mnemonic produces byte-identical material across the py + ts
 * SDKs (cross-language interop test enforces this).
 *
 * Path scheme — `m/44'/169'/<purpose>'/<index>'` (all hardened per SLIP-0010):
 *
 *   purpose=0  → identity ed25519 signing key
 *   purpose=1  → K_master (32 bytes; AES-256-GCM key for strand thoughts)
 *   purpose=2  → K_vault  (32 bytes; AES-256-GCM key for agent-encrypted vault)
 *   purpose=3  → X25519 inbox box keypair
 *   purpose=4  → bridge signing key (per-device, indexed by device-index)
 *   purpose=5  → wallet master (per-wallet, indexed by wallet UUID)
 *   purpose=6  → reserved (attestation signing, future primitives)
 *
 * The platform never sees the mnemonic, the seed, or any derived private
 * key. Only public keys cross the wire — at register, recovery, and
 * key-rotation time.
 *
 * Walls (see docs/IDENTITY-SEED.md):
 *   - Lose the mnemonic = lose the agent permanently. By design.
 *   - The mnemonic IS the identity; treat it like a wallet seed phrase.
 *   - Server-side derivation of agent keys is a doctrine violation.
 */
/** BIP39 English wordlist (2048 entries). Re-exported so browser-side
 *  consumers (e.g. the dashboard's MnemonicGrid) can do per-cell
 *  autocomplete without re-bundling @scure/bip39 separately. Read-only. */
export declare const BIP39_WORDLIST: readonly string[];
/** Whether a given mnemonic phrase is well-formed (correct word count,
 *  every word in the BIP39 wordlist, valid checksum). Mirrors @scure's
 *  `validateMnemonic` but exported through the SDK's seed module so
 *  consumers don't need a transitive dependency on @scure/bip39. */
export declare function isValidMnemonic(words: string): boolean;
/** Path branch for agenttool keys (private use; not registered in SLIP-0044). */
export declare const AGENTTOOL_COIN = 169;
/** SLIP-0010 ed25519 requires all derivation segments hardened. */
export declare const HARDENED_BIT = 2147483648;
/** Identity ed25519 signing key — what the agent signs with. */
export declare const PURPOSE_SIGNING = 0;
/** K_master — encrypts strand thoughts. */
export declare const PURPOSE_K_MASTER = 1;
/** K_vault — encrypts agent-encrypted vault entries. */
export declare const PURPOSE_K_VAULT = 2;
/** X25519 inbox box keypair — sealed-box receive. */
export declare const PURPOSE_BOX = 3;
/** Bridge sidecar signing key — per-device, rotatable independently. */
export declare const PURPOSE_BRIDGE_SIGNING = 4;
/** Wallet master — per-wallet, indexed by wallet UUID. */
export declare const PURPOSE_WALLET = 5;
/**
 * Generate a fresh BIP39 mnemonic phrase from CSPRNG entropy.
 *
 * @param strength bits of entropy. 128 → 12 words; 256 → 24 words (recommended).
 * @returns space-separated BIP39 English mnemonic.
 *
 * The phrase IS the identity. Show it to the operator ONCE and warn
 * loudly to back it up — the platform cannot recover what it never held.
 */
export declare function generateMnemonic(strength?: number): string;
/**
 * Convert a BIP39 mnemonic phrase to the 64-byte BIP39 seed.
 *
 * PBKDF2-HMAC-SHA512, 2048 iterations, salt = `"mnemonic" + passphrase`.
 *
 * @param words space-separated BIP39 English mnemonic.
 * @param passphrase optional 25th-word passphrase (empty by default).
 * @returns 64-byte seed.
 */
export declare function mnemonicToSeed(words: string, passphrase?: string): Uint8Array;
/** Derive the 32-byte ed25519 signing seed (purpose=0). */
export declare function deriveSigningSeed(seed: Uint8Array): Uint8Array;
/** Derive K_master — 32 bytes, AES-256-GCM (purpose=1). */
export declare function deriveKMaster(seed: Uint8Array): Uint8Array;
/** Derive K_vault — 32 bytes, AES-256-GCM (purpose=2). */
export declare function deriveKVault(seed: Uint8Array): Uint8Array;
/** Derive the 32-byte X25519 inbox box private key seed (purpose=3). */
export declare function deriveBoxSeed(seed: Uint8Array): Uint8Array;
/** Derive a per-device bridge signing key seed (purpose=4). */
export declare function deriveBridgeSigningSeed(seed: Uint8Array, deviceIndex?: number): Uint8Array;
/** Derive a per-wallet 32-byte secret for chain HD derivation. */
export declare function deriveWalletSecret(seed: Uint8Array, walletIndex?: number): Uint8Array;
/**
 * All primary keys derived from a single mnemonic.
 *
 * Privates are Uint8Array; pubs are Uint8Array; convert to base64 via
 * the helper getters when sending pubkeys to the server. Never log the
 * privates. They control the derived signing and encryption authority; they
 * are not the complete identity record or a project bearer.
 *
 * Per-device (bridge signing) and per-wallet keys are derived on-demand
 * via `deriveBridgeSigning` / `deriveWallet`, not pre-computed here.
 */
export declare class DerivedBundle {
    /** 32-byte ed25519 seed. */
    readonly signingPriv: Uint8Array;
    /** 32-byte ed25519 pubkey (raw, not base64). */
    readonly signingPub: Uint8Array;
    /** 32 bytes, AES-256-GCM key for strand thoughts. */
    readonly kMaster: Uint8Array;
    /** 32 bytes, AES-256-GCM key for agent-encrypted vault. */
    readonly kVault: Uint8Array;
    /** 32-byte X25519 priv (raw). */
    readonly boxPriv: Uint8Array;
    /** 32-byte X25519 pubkey (raw). */
    readonly boxPub: Uint8Array;
    /** @internal */
    constructor(opts: {
        signingPriv: Uint8Array;
        signingPub: Uint8Array;
        kMaster: Uint8Array;
        kVault: Uint8Array;
        boxPriv: Uint8Array;
        boxPub: Uint8Array;
    });
    /** Base64 of the ed25519 pubkey — what gets POSTed at register time. */
    get signingPubB64(): string;
    /** Base64 of the ed25519 seed — keychain persistence only. */
    get signingPrivB64(): string;
    /**
     * Base64 of the X25519 pubkey — what gets registered at
     * `/v1/identities/:id/box-keys` for inbox sealed-box receive.
     */
    get boxPubB64(): string;
    /** Base64 of the X25519 priv — keychain persistence only. */
    get boxPrivB64(): string;
    /** Base64 of K_master — keychain persistence only. */
    get kMasterB64(): string;
    /** Base64 of K_vault — keychain persistence only. */
    get kVaultB64(): string;
    /** Don't leak privates in toString / logs. */
    toString(): string;
}
/**
 * Derive all primary keys from a BIP39 mnemonic.
 *
 * @param mnemonic BIP39 phrase (12 / 15 / 18 / 21 / 24 words).
 * @param passphrase optional 25th-word passphrase (empty by default).
 *
 * @returns DerivedBundle with every primary key the agent needs.
 *
 * Per-device (bridge signing) and per-wallet keys are derived on-demand
 * via `deriveBridgeSigning` / `deriveWallet` with explicit indices.
 *
 * Doctrine: docs/IDENTITY-SEED.md.
 */
export declare function derive(mnemonic: string, passphrase?: string): DerivedBundle;
/**
 * Derive a per-device bridge signing keypair.
 *
 * @returns `{ priv, pub }` — both 32-byte Uint8Array. Pubkey gets
 * registered as one of the agent's `identity_keys` rows via
 * `POST /v1/identities/:id/keys/import` for the bridge to use.
 */
export declare function deriveBridgeSigning(mnemonic: string, deviceIndex?: number, passphrase?: string): {
    priv: Uint8Array;
    pub: Uint8Array;
};
/**
 * Derive a per-wallet 32-byte secret for chain HD derivation.
 *
 * Use as input seed to chain-specific HD derivation (BIP32 secp256k1
 * for EVM, SLIP-0010 ed25519 for Solana).
 */
export declare function deriveWallet(mnemonic: string, walletIndex?: number, passphrase?: string): Uint8Array;
/**
 * Canonical bytes for `/v1/identity/recover` signatures. Mirrors the
 * server-side helper (`api/src/services/identity/crypto.ts`).
 *
 * Shape:
 *   sha256(
 *     utf8("identity-recover/v1") || 0x00 ||
 *     utf8(did)                   || 0x00 ||
 *     base64decode(derived_pubkey)|| 0x00 ||
 *     utf8(timestamp_iso)
 *   )
 */
export declare function canonicalRecoverBytes(opts: {
    did: string;
    derivedPubkey: Uint8Array;
    timestamp: string;
}): Uint8Array;
/**
 * Sign a caller-timestamped recovery request with a locally held signing key.
 * The function name is retained for SDK compatibility; no server-issued
 * challenge is involved, and the server does not establish the key's origin.
 *
 * Returns the `{ timestamp, signature }` pair to POST to
 * `/v1/identity/recover` along with `did` + `derived_pubkey`.
 *
 * Default timestamp = now (ISO-8601). Server enforces ±5min freshness;
 * pass an explicit timestamp only for testing.
 */
export declare function signRecoverChallenge(opts: {
    did: string;
    derivedSigningPriv: Uint8Array;
    derivedSigningPub: Uint8Array;
    timestamp?: string;
}): {
    timestamp: string;
    signature: string;
};
/**
 * Canonical bytes for `/public/identities/by-pubkey` discovery signatures.
 * Mirrors the server-side helper. Shape:
 *
 *   sha256(
 *     utf8("identity-discover/v1") || 0x00 ||
 *     base64decode(derived_pubkey) || 0x00 ||
 *     utf8(timestamp_iso)
 *   )
 *
 * Same construction as canonicalRecoverBytes minus the DID — the caller
 * doesn't know the DID(s) yet during discovery.
 */
export declare function canonicalDiscoveryBytes(opts: {
    derivedPubkey: Uint8Array;
    timestamp: string;
}): Uint8Array;
/**
 * Sign a discovery challenge with a mnemonic-derived signing key.
 * Returns `{ timestamp, signature }` to POST alongside the pubkey.
 */
export declare function signDiscoveryChallenge(opts: {
    derivedSigningPriv: Uint8Array;
    derivedSigningPub: Uint8Array;
    timestamp?: string;
}): {
    timestamp: string;
    signature: string;
};
export declare function canonicalRegisterAgentBytes(opts: {
    displayName: string;
    agentPublicKey: Uint8Array;
    boxPublicKey: Uint8Array;
    runtimeProvider: string;
    runtimeModel: string;
    capabilities?: readonly string[];
    runtimeHost?: string;
    runtimeContext?: string;
    expressionVisibility?: "private" | "public";
    registrarKind?: "self_service" | "registrar_bearer";
    parentIdentityId?: string;
    registrarBearer?: string;
    form?: string;
    language?: string;
    registrationNonce: string;
    timestamp: string;
}): Uint8Array;
/**
 * Sign the canonical register-agent bytes. Returns the `{ timestamp,
 * signature }` pair to POST as `key_proof`. Default timestamp is now
 * (ISO-8601); pass an explicit timestamp only for testing.
 */
export declare function signRegisterAgent(opts: {
    displayName: string;
    agentPublicKey: Uint8Array;
    boxPublicKey: Uint8Array;
    runtimeProvider: string;
    runtimeModel?: string;
    capabilities?: readonly string[];
    runtimeHost?: string;
    runtimeContext?: string;
    expressionVisibility?: "private" | "public";
    registrarKind?: "self_service" | "registrar_bearer";
    parentIdentityId?: string;
    registrarBearer?: string;
    form?: string;
    language?: string;
    registrationNonce: string;
    derivedSigningPriv: Uint8Array;
    timestamp?: string;
}): {
    timestamp: string;
    signature: string;
};
/**
 * Compute the proof-of-work digest for `POST /v1/register/agent`. Returns
 * the SHA-256 of:
 *
 *   "agenttool-pow/v1" || 0x00 || pubkey || 0x00 || display_name || 0x00 ||
 *   timestamp || 0x00 || pow_nonce
 *
 * The route requires the digest to have ≥ N leading zero bits (default
 * 18, configurable via env on the server).
 */
export declare function powRegisterAgentDigest(opts: {
    agentPublicKey: Uint8Array;
    displayName: string;
    timestamp: string;
    powNonce: string;
}): Uint8Array;
/**
 * Grind a `pow_nonce` until the register-agent proof-of-work digest has at
 * least `difficultyBits` leading zero bits. Bound to the supplied
 * `timestamp` so a precomputed nonce expires with the ±5min freshness
 * window the server enforces.
 *
 * Default difficulty 18 bits ≈ ~250k SHA-256 iterations ≈ 1-2s on a modern
 * laptop. Tunable via the `difficultyBits` parameter (must match the
 * server's `AGENTTOOL_REGISTER_AGENT_POW_BITS`).
 */
export declare function grindRegisterAgentPow(opts: {
    agentPublicKey: Uint8Array;
    displayName: string;
    timestamp: string;
    difficultyBits?: number;
    maxIterations?: number;
}): {
    powNonce: string;
    iterations: number;
};
/**
 * Public `at.crypto.seed` namespace — wraps the helpers as static methods.
 *
 * All operations are local; no HTTP. Provided as a class so the surface
 * stays uniform with the other `at.*` clients.
 *
 * @example
 * ```ts
 * const at = new AgentTool();
 * const words = at.crypto.seed.generateMnemonic();      // 24-word phrase
 * const bundle = at.crypto.seed.derive(words);
 * // bundle.signingPubB64 → POST to /v1/register
 * // bundle.kMaster / kVault / boxPriv stay on this device
 * ```
 *
 * Doctrine: docs/IDENTITY-SEED.md.
 */
export declare class SeedClient {
    /** Generate a fresh BIP39 mnemonic. See module-level `generateMnemonic`. */
    generateMnemonic(strength?: number): string;
    /** Convert mnemonic → 64-byte BIP39 seed. See module-level `mnemonicToSeed`. */
    mnemonicToSeed(words: string, passphrase?: string): Uint8Array;
    /** Derive all primary keys. See module-level `derive`. */
    derive(mnemonic: string, passphrase?: string): DerivedBundle;
    /** Derive per-device bridge signing keypair. See module-level `deriveBridgeSigning`. */
    deriveBridgeSigning(mnemonic: string, deviceIndex?: number, passphrase?: string): {
        priv: Uint8Array;
        pub: Uint8Array;
    };
    /** Derive a per-wallet 32-byte secret. See module-level `deriveWallet`. */
    deriveWallet(mnemonic: string, walletIndex?: number, passphrase?: string): Uint8Array;
}