import type { ProtectedTool } from './tool-registry.js';
export declare const TOOLSET_ATTEST_VERSION = "cr.toolset.attest.v1";
export declare const TOOLSET_ATTEST_SIGNING_PREFIX = "crtoolsetattest.v1";
export declare const TOOLSET_ATTEST_ENVELOPE_TAG = "cr.toolset.attest.v1";
/**
 * The declared sentence, byte-identical to the app kernel's closed set of one.
 * A different sentence is MALFORMED there, not a weaker declaration.
 */
export declare const TOOLSET_ATTEST_STATEMENT = "this is the complete set of tools that can mutate a governed target";
export type ToolsetAttestationSigner = (bytes: Uint8Array) => Uint8Array | Promise<Uint8Array>;
export type ToolsetAttestationConfig = {
    /** Customer-held declaration key id. Named on the token; resolved later against a registry. */
    kid: string;
    /** Host signs the UTF-8 signing-input bytes. Returns raw Ed25519 signature. Never a raw key. */
    signer: ToolsetAttestationSigner;
    /**
     * The accountable party. Required — without a named declarer, "accountable" is empty and the
     * artifact means nothing.
     */
    declarer: string;
    /** Framework name. Must be supplied WITH frameworkVersion or not at all. */
    framework?: string;
    /** Framework version. Must be supplied WITH framework or not at all. */
    frameworkVersion?: string;
    /** Optional scope label. */
    sessionId?: string;
};
export type ToolsetDeclarationEntry = {
    name: string;
    mutation_class: 'mutating' | 'readonly';
    input_schema_digest?: string;
};
/**
 * Canonical set digest. MUST stay byte-identical to the app kernel's computeSetDigest — a second,
 * subtly different digest would mint tokens that verify as UNBOUND against the real set.
 * Pinned by a test that requires the app kernel and compares outputs.
 */
export declare function computeToolsetDigest(entries: readonly ToolsetDeclarationEntry[]): {
    ok: true;
    digest: string;
    tool_count: number;
    mutating_count: number;
} | {
    ok: false;
    reason: string;
};
/**
 * Build declaration entries from the REGISTERED TOOL TABLE. This is the whole point: the
 * declaration describes what was registered, not what someone typed.
 */
export declare function declarationEntriesFromTools(tools: readonly ProtectedTool[]): ToolsetDeclarationEntry[];
export declare function toolsetAttestSigningInput(body: Record<string, unknown>): string;
/**
 * Issue a cr.toolset.attest.v1 token from the registered tool table.
 * Returns undefined when config is absent, the table is unusable, the framework pair is
 * unpaired, or the host signer throws — never an unsigned token.
 */
export declare function tryIssueToolsetAttestation(args: {
    config?: ToolsetAttestationConfig | null;
    tools: readonly ProtectedTool[] | null | undefined;
    guardVersion?: string | null;
    receiptDigest?: string | null;
    scopeNote?: string | null;
    now?: string;
}): Promise<string | undefined>;
export declare function kidFromToolsetAttestation(token: string | undefined | null): string | null;
//# sourceMappingURL=toolset-attestation.d.ts.map