import type { AttributionAction, AttributionAxes, AttributionPrimitive } from './types.js';
/** Derive action_ref from the action tuple. §1.2 / §3.4.
 *
 *  The spec pseudocode in §2.7 uses string concatenation (`agentId || type
 *  || canonical(params) || nonce`), but Theorem 1's reduction relies on
 *  canonical(T) being injective (A1). Plain string concatenation is not
 *  self-delimiting, so two distinct tuples could produce the same byte
 *  string. We adopt canonical(T) on the full tuple, which is injective by
 *  construction and matches the security argument.
 *
 *  Canonicalization uses strict RFC 8785 JCS (canonicalHashJCS), not the
 *  legacy null-stripping APS variant. ATTRIBUTION-PRIMITIVE-v1.1 §1.6
 *  pins all hashing to RFC 8785, and Theorem 1's Assumption A1
 *  (canonicalization injectivity) requires that semantically distinct
 *  action tuples produce distinct canonical bytes — which null-stripping
 *  would violate ({k:null, v:1} and {v:1} would collide). */
export declare function computeAttributionActionRef(action: AttributionAction): string;
export interface ConstructAttributionParams {
    /** The action being attested. Used to derive action_ref. */
    action: AttributionAction;
    /** The four axes with their entries. Unsorted is fine — canonicalization
     *  will order them. */
    axes: AttributionAxes;
    /** Issuer DID of the gateway or agent producing the receipt. */
    issuer: string;
    /** Ed25519 private key (hex) that signs the envelope. Must match the
     *  public key registered for `issuer` out-of-band. */
    issuerPrivateKey: string;
    /** Override the timestamp (test fixtures, replayed audits). Must satisfy
     *  §2.5 — millisecond precision, trailing Z. Defaults to now(). */
    timestamp?: string;
}
/** Build and sign a complete AttributionPrimitive. §2.7. */
export declare function constructAttributionPrimitive(params: ConstructAttributionParams): AttributionPrimitive;
/** Re-sign a primitive whose axes or metadata have changed (e.g., after
 *  applying decay in axis P). Returns a fresh primitive; the input is not
 *  mutated. Caller is responsible for providing a new timestamp if the
 *  resigned receipt should be distinct under replay protection. */
export declare function resignAttributionPrimitive(primitive: AttributionPrimitive, issuerPrivateKey: string, opts?: {
    timestamp?: string;
    axes?: AttributionAxes;
    action?: AttributionAction;
}): AttributionPrimitive;
//# sourceMappingURL=construct.d.ts.map