import type { CognitiveAttestationEnvelope, UnsignedCognitiveAttestationEnvelope } from './types.js';
/**
 * Canonicalize an envelope for signing. The signature field is set to the
 * empty string before serialization so that signing and verification
 * agree on the bytes-under-signature without either side rebuilding the
 * envelope from a partial shape.
 */
export declare function canonicalizeForSignature(envelope: UnsignedCognitiveAttestationEnvelope | CognitiveAttestationEnvelope): string;
/**
 * Sign an unsigned envelope with an Ed25519 private key (hex). Derives
 * the public key from the private key and writes it into `agent_id` on
 * the returned envelope; this guarantees that the embedded `agent_id`
 * matches the signing key, which the verifier checks against.
 *
 * If the caller provides their own `agent_id` on the input, this helper
 * still derives the public key from the private key and overwrites the
 * field, because a divergence between the embedded agent_id and the
 * signing key is always a bug. Use `publicKeyFromPrivate` upstream if a
 * pre-flight check is needed.
 */
export declare function signCognitiveAttestation<T extends UnsignedCognitiveAttestationEnvelope>(privateKeyHex: string, unsigned: T): T & {
    readonly signature: string;
    readonly agent_id: string;
};
//# sourceMappingURL=envelope.d.ts.map