/**
 * The inputs that identify one specific action a presentation authorizes
 * (SPEC §6.4.9). Which fields are populated is deployment-defined —
 * absent fields encode as zero-length and the construction stays
 * well-defined.
 */
export interface OperationContext {
    /** Scope the action requires (e.g. "files:write"). */
    required_scope?: string;
    /** Action/operation type (e.g. "git.push", "tool.invoke"). */
    operation?: string;
    /** Target resource identity. */
    resource_id?: string;
    /** Path within the resource. */
    requested_path?: string;
    /**
     * Absent/empty, or exactly 32 bytes: the SHA-256 of the canonical
     * request payload, where one exists.
     */
    payload_digest?: Uint8Array;
}
/**
 * The inputs that identify the session a presentation belongs to, plus
 * the request_hash binding the specific operation (SPEC §6.4.9). The
 * Middleware Custody Profile (SPEC §15.2.1) requires all of them; other
 * deployments populate what they have.
 */
export interface SessionContextInputs {
    /**
     * The verifier's identity (e.g. its public key ID). Including it makes
     * cross-verifier challenge forwarding detectable at the cryptographic
     * layer (SPEC §15.1).
     */
    verifier_id?: string;
    /** The deployment's workspace/tenant identifier. */
    workspace_id?: string;
    /** The presenting agent's identity. */
    agent_id?: string;
    /** The session identifier. */
    session_id?: string;
    /** The specific invocation within the session. */
    invocation_id?: string;
    /**
     * Exactly 32 bytes — the operationContextHash of the action being
     * authorized. A deployment with no operation-specific inputs derives
     * it from an all-empty operation context. Binding the session but not
     * the operation would let an intermediary attach a valid proof to the
     * wrong action inside the right session.
     */
    request_hash: Uint8Array;
}
/**
 * The SPEC §6.4.9 operation-context preimage: the domain tag followed by
 * every field length-prefixed, in canonical order. Throws if
 * payload_digest is neither absent/empty nor exactly 32 bytes.
 */
export declare function operationContextBytes(ctx: OperationContext): Uint8Array;
/**
 * The 32-byte request_hash: SHA-256 over the SPEC §6.4.9
 * operation-context bytes.
 */
export declare function operationContextHash(ctx: OperationContext): Uint8Array;
/**
 * The SPEC §6.4.9 session-context preimage: the domain tag followed by
 * every field length-prefixed, in canonical order. Throws unless
 * request_hash is exactly 32 bytes — use operationContextHash to derive
 * it, over an all-empty operation context when the deployment has no
 * operation-specific inputs.
 */
export declare function sessionContextBytes(inputs: SessionContextInputs): Uint8Array;
/**
 * The 32-byte session_context: SHA-256 over the SPEC §6.4.9
 * session-context bytes — what a session-bound deployment passes as
 * VerifyOptions.session_context (and what the agent side includes in the
 * challenge signing bytes, SPEC §6.4.2). Verification receipts and audit
 * records bind this hash, never the preimage.
 */
export declare function buildSessionContext(inputs: SessionContextInputs): Uint8Array;
//# sourceMappingURL=operation_context.d.ts.map