import { type SignOptions } from "./signature.js";
import { type H2AEnvelope } from "./types.js";
type CreateEnvelopeInput<TBody> = Omit<H2AEnvelope<TBody>, "protocol" | "version" | "createdAt"> & {
    createdAt?: string;
};
export declare function createEnvelope<TBody>(input: CreateEnvelopeInput<TBody>): H2AEnvelope<TBody>;
/**
 * Sign an envelope's provenance (DEC-073). Returns a new envelope with the
 * ed25519 signature appended to `signatures[]`; the original is not mutated.
 * This is the "signed bearer" primitive underpinning authenticated transport
 * (DEC-032): a recipient can verify *who* emitted an envelope independently of
 * the channel it arrived on.
 */
export declare function signEnvelope<TBody>(envelope: H2AEnvelope<TBody>, options: SignOptions): H2AEnvelope<TBody>;
/**
 * Verify an envelope's signature(s) against a public key (DEC-073). With
 * `options.by`, only that signer's signature(s) are checked; otherwise any
 * signature that verifies against the key counts. Returns false when the
 * envelope carries no (matching) signature.
 */
export declare function verifyEnvelopeSignature<TBody>(envelope: H2AEnvelope<TBody>, publicKeyPem: string, options?: {
    by?: string;
}): boolean;
/**
 * Field-level envelope validator. Collects ALL failures into `errors` rather
 * than stopping at the first. Used by `isH2AEnvelope` so the two never drift.
 */
export declare function validateH2AEnvelope(value: unknown): {
    ok: true;
} | {
    ok: false;
    errors: string[];
};
export declare function isH2AEnvelope<TBody = unknown>(value: unknown): value is H2AEnvelope<TBody>;
export {};
//# sourceMappingURL=envelope.d.ts.map