import type { DecisionResultEnvelope } from './types.js';
import type { MonitoringDelivery } from './monitoring-delivery.js';
export declare const MONITOR_ATTEST_VERSION = "cr.monitor.attest.v1";
export declare const MONITOR_ATTEST_SIGNING_PREFIX = "crmonattest.v1";
export declare const MONITOR_ATTEST_ENVELOPE_TAG = "cr.monitor.attest.v1";
export type MonitoringAttestationSigner = (bytes: Uint8Array) => Uint8Array | Promise<Uint8Array>;
export type MonitoringAttestationConfig = {
    /** Customer-held monitoring key id. Named on the token; resolved later against a registry. */
    kid: string;
    /** Host signs the UTF-8 signing-input bytes. Returns raw Ed25519 signature. Never a raw key. */
    signer: MonitoringAttestationSigner;
};
export declare function monitorAttestSigningInput(body: Record<string, unknown>): string;
export declare function receiptDigestOfToken(token: string): string;
/**
 * Issue a cr.monitor.attest.v1 token after a CWM arm. Returns undefined when
 * config is absent, required bindings are missing, or the host signer throws.
 */
export declare function tryIssueMonitoringAttestation(args: {
    config?: MonitoringAttestationConfig | null;
    delivery: MonitoringDelivery;
    envelope: DecisionResultEnvelope | null | undefined;
    now?: string;
}): Promise<string | undefined>;
export declare function kidFromMonitoringAttestation(token: string | undefined | null): string | null;
//# sourceMappingURL=monitoring-attestation.d.ts.map