/**
 * Ed25519 producer signing per SPEC/uvrn-signing-v1.md (`uvrn-sig-1`).
 * One signing story end-to-end: the same curve the worker seal and @uvrn/canon already use.
 * Node `crypto` only — no external dependencies. The signature signs the receipt hash; it is
 * never part of the hash (additive rule).
 */
import type { NetworkReceipt, ReceiptSignature } from '../types';
export declare const SIG_VERSION: "uvrn-sig-1";
/** Keys are base64 of the raw 32 bytes (seed for private, point for public) per spec §1. */
export interface ReceiptKeyPair {
    publicKey: string;
    privateKey: string;
}
/** generateReceiptKeyPair creates a fresh Ed25519 keypair in the spec's raw-base64 encoding. */
export declare function generateReceiptKeyPair(): ReceiptKeyPair;
/** sha256Hex digests a canonical string to lowercase hex. */
export declare function sha256Hex(canonical: string): string;
/**
 * computeNetworkReceiptHash recomputes the `uvrn-receipt-4` prefixed hash over the declared
 * field list (SPEC/uvrn-receipt-v1.md §2.4).
 */
export declare function computeNetworkReceiptHash(receipt: Partial<NetworkReceipt> | Record<string, unknown>): string;
/** SignReceiptOptions carry the producer key material and reference. */
export interface SignReceiptOptions {
    /** Base64 raw 32-byte Ed25519 seed. */
    privateKey: string;
    /** Opaque key reference verifiers can resolve, e.g. `acme-pk-2026-v1`. */
    publicKeyRef: string;
    /** Optional ISO timestamp recorded in the envelope and the signed payload. */
    signedAt?: string;
}
/**
 * signReceipt returns a copy of the receipt with the `uvrn-sig-1` producer signature attached.
 * The receipt hash must verify before signing; signing never mutates the input.
 */
export declare function signReceipt(receipt: NetworkReceipt, options: SignReceiptOptions): NetworkReceipt;
/** SignatureCheck reports the signature half of verification on its own. */
export interface SignatureCheck {
    signatureOk: boolean;
    error?: string;
}
/**
 * verifySignature checks the producer signature against a resolved public key
 * (base64 raw 32 bytes). It does not re-check integrity — use verifyReceiptFull for both.
 */
export declare function verifySignature(receipt: NetworkReceipt, publicKey: string): SignatureCheck;
/**
 * verifyDetachedSignature checks a producer signature given only the hash, schema version, and
 * signature envelope — no full receipt required. This is what registries and reputation systems
 * use when they hold receipt metadata rather than the whole envelope.
 */
export declare function verifyDetachedSignature(args: {
    receiptHash: string;
    schemaVersion: string;
    signature: ReceiptSignature;
}, publicKey: string): SignatureCheck;
/** KeyResolution supplies public keys for verifyReceiptFull, checked in order. */
export interface KeyResolution {
    /** Direct public key (base64 raw 32 bytes) — used regardless of publicKeyRef. */
    publicKey?: string;
    /** Map of publicKeyRef → public key. */
    keys?: Record<string, string>;
}
/**
 * FullVerifyResult reports integrity and signature separately (gaps recorded, not hidden).
 * `verified` is true only when the hash recomputes AND a present signature verifies.
 * Honest vocabulary: integrity alone is "integrity-checked", never "verified".
 */
export interface FullVerifyResult {
    verified: boolean;
    integrityOk: boolean;
    /** Undefined when the receipt carries no signature. */
    signatureOk?: boolean;
    signed: boolean;
    error?: string;
}
/**
 * verifyReceiptFull = integrity (hash recompute) + signature + key lookup
 * (SPEC/uvrn-signing-v1.md §2.4). An unsigned receipt can be integrity-checked but never
 * `verified`. A requested-but-unresolvable key fails loudly with KEY_NOT_FOUND.
 */
export declare function verifyReceiptFull(receipt: NetworkReceipt, resolution?: KeyResolution): FullVerifyResult;
//# sourceMappingURL=index.d.ts.map