import { type ClusterMessage } from './types.js';
/**
 * The bytes a signature covers.
 *
 * Field order is fixed here rather than taken from JSON.stringify of the whole
 * object, so a signature computed on one node verifies on another regardless
 * of how either built the object. `surfaceId` is inside the signed form: an
 * unsigned surfaceId could be rewritten in flight to redirect a claim at a
 * different surface.
 */
export declare function canonicalizeMessage(message: ClusterMessage): string;
/** Hex HMAC-SHA256 of the canonical form. */
export declare function signMessage(message: ClusterMessage, secret: string): string;
/** Serialize for the wire, signing when a secret is configured. */
export declare function encodeMessage(message: ClusterMessage, secret: string): string;
/** Why a datagram was not accepted. `null` reason means it decoded cleanly. */
export interface ClusterDecodeResult {
    readonly message: ClusterMessage | null;
    readonly rejected: string | null;
}
/**
 * Parse and authenticate a datagram.
 *
 * When `secret` is set the signature is required and compared in constant
 * time. When it is empty a `sig` field is simply ignored, a cluster that has
 * not been given a secret has no basis on which to judge one.
 */
export declare function decodeMessage(raw: string, secret: string): ClusterDecodeResult;
//# sourceMappingURL=protocol.d.ts.map