import type { CoverageObserved } from './coverage-observed.js';
export declare const COVERAGE_ATTEST_VERSION = "cr.coverage.attest.v1";
export declare const COVERAGE_ATTEST_SIGNING_PREFIX = "crcovattest.v1";
export declare const COVERAGE_ATTEST_ENVELOPE_TAG = "cr.coverage.attest.v1";
export type CoverageAttestationSigner = (bytes: Uint8Array) => Uint8Array | Promise<Uint8Array>;
export type CoverageAttestationConfig = {
    /** Customer-held coverage key id. Named on the token; resolved later against a registry. */
    kid: string;
    /** Host signs the UTF-8 signing-input bytes. Returns raw Ed25519 signature. Never a raw key. */
    signer: CoverageAttestationSigner;
    /** Scope label for the statement (e.g. a session id). Required — a statement needs a subject. */
    sessionId: string;
};
export declare function coverageAttestSigningInput(body: Record<string, unknown>): string;
/**
 * Issue a cr.coverage.attest.v1 token from a coverage snapshot. Returns undefined when config is
 * absent, the snapshot is unusable, or the host signer throws — never an unsigned token.
 */
export declare function tryIssueCoverageAttestation(args: {
    config?: CoverageAttestationConfig | null;
    coverage: CoverageObserved | null | undefined;
    decisionId?: string | null;
    receiptDigest?: string | null;
    now?: string;
}): Promise<string | undefined>;
export declare function kidFromCoverageAttestation(token: string | undefined | null): string | null;
//# sourceMappingURL=coverage-attestation.d.ts.map