/** Raised when a value cannot be canonicalized under RFC 8785. Subclasses the
 *  built-in Error that canonicalizeJCS already throws, so any existing handler
 *  that catches Error (or `catch (e)`) still catches it and fails closed. */
export declare class JcsCanonicalizationError extends Error {
    readonly code: string;
    /** Stable machine-readable category, shared across the APS SDKs. */
    readonly category = "invalid_unicode";
    /** Specific failure within the category, e.g. 'lone_surrogate'. */
    readonly reason: string;
    constructor(code: string, message: string, reason?: string);
}
/** RFC 8785 JSON Canonicalization Scheme.
 *  Differences from legacy canonicalize():
 *  - null values ARE preserved (not filtered)
 *  - undefined is REJECTED at any depth with a TypeError naming its path.
 *    undefined is not a JSON value and RFC 8785 defines no canonical form for
 *    it, so coercing it would sign a value the caller never wrote (#101).
 *    A caller that needs the byte null on the wire passes an explicit null.
 *  - Number serialization follows ES2015 spec
 *  - All other behavior is identical (sorted keys, no whitespace)
 *
 *  The undefined walk runs ONCE here, over the whole value, before any byte is
 *  emitted. canonicalizeValue() below is the recursive emitter and does not
 *  re-assert: folding the walk into the recursion would rescan every subtree at
 *  every depth and make canonicalization O(n * depth). */
export declare function canonicalizeJCS(value: unknown): string;
/** RFC 8785 canonicalization for a NEW WRITE, with the APS unsafe-integer rule applied.
 *
 *  Byte-identical to canonicalizeJCS() for every value it accepts. The only difference
 *  is that an integer-valued number outside the interoperable IEEE 754 range is refused
 *  rather than emitted. See core/write-policy.ts for the rule and its rationale.
 *
 *  Use this at signing and new-write boundaries only. A verifier rebuilding the preimage
 *  of an artifact signed before this rule existed must keep calling canonicalizeJCS(),
 *  or it would refuse bytes it accepted before.
 *
 *  The number check runs INSIDE the emitting walk, on the same read that produces the
 *  byte, so a getter or Proxy that answers differently on a second read cannot slip an
 *  unsafe integer past it. Note the pre-existing assertNoUndefined() walk is still a
 *  separate traversal; that exposure predates this change and is not addressed here. */
export declare function canonicalizeJCSForWrite(value: unknown): string;
/** @deprecated canonicalizeJCS() is itself strict as of #101; this alias exists only so the name keeps resolving. */
export declare function canonicalizeJCSStrict(value: unknown): string;
/** Detect which canonicalization variant was likely used.
 *  Checks if null values are present — JCS preserves them, legacy strips them. */
export declare function detectCanonicalVariant(obj: unknown, canonicalString: string): 'jcs' | 'legacy' | 'ambiguous';
/** Cross-language test vector for canonicalization verification */
export interface CanonicalizationTestVector {
    id: string;
    description: string;
    input: unknown;
    expected_jcs: string;
    expected_legacy: string;
    sha256_jcs: string;
    sha256_legacy: string;
}
/** SHA-256 (lowercase hex) of canonicalizeJCS(obj). Strict-RFC-8785
 *  counterpart of canonicalHash() from ./canonical.ts. Use this for any
 *  cross-implementation hash whose conformance pin requires strict JCS
 *  (e.g. action_ref per draft-pidlisnyi-aps-01 §4.1). */
export declare function canonicalHashJCS(obj: Record<string, unknown>): string;
/** Write-boundary twin of canonicalHashJCS().
 *
 *  Reaches a canonicalizer only indirectly, so a call-site census over canonicalizer
 *  usage cannot see it. Emits the same digest as canonicalHashJCS() for every value it
 *  accepts; the only difference is that an integer-valued number outside the
 *  interoperable IEEE 754 range is refused instead of hashed. Use at signing and
 *  new-write boundaries ONLY: canonicalHashJCS() stays unrestricted because verifiers
 *  re-derive references with it over artifacts signed before this rule. */
export declare function canonicalHashJCSForWrite(obj: Record<string, unknown>): string;
/** Built-in test vectors for cross-language verification */
export declare function getTestVectors(): CanonicalizationTestVector[];
//# sourceMappingURL=canonical-jcs.d.ts.map