import type { AuthorityDelegationBodyV1, AuthorityDelegationV1, RevocationResolution, VerificationKeyResolver } from './types.js';
/**
 * Create a deterministic v1 root record from explicit body fields and an Ed25519 key.
 *
 * Issues roots only. Refuses a body already carrying an own delegation_id or signature
 * member (SCHEMA_INVALID), so the returned record's delegation_id always recomputes
 * from its own body: draft section 3.1 (lines 484-490) and section 3.6 (lines
 * 700-704). Refuses a body whose parent_delegation_id is not null (PARENT_MISMATCH):
 * section 3.1, line 428, states that parent_delegation_id is null only for a root
 * selected by verifier trust policy. A child is minted only through
 * issueSubAuthorityDelegation, which performs the section 3.6 (lines 695-704) parent
 * checks before signing.
 *
 * The body is snapshotted to plain JSON data (see plain-data.ts) first; every check
 * below, and the signing itself, reads only that snapshot, never the caller's original
 * body, so a getter or a Proxy trap in `body` cannot answer differently the second
 * time it would otherwise have been read.
 */
export declare function issueAuthorityDelegation(body: AuthorityDelegationBodyV1, privateKey: string): AuthorityDelegationV1;
/**
 * Options required to issue a delegated child. `resolveVerificationKey` and
 * `resolveRevocation` let issueSubAuthorityDelegation verify the immediate
 * parent's signature and live status before minting the child, per draft
 * section 3.6.
 */
export interface SubAuthorityIssueOptions {
    /** Canonical UTC-millisecond timestamp at which the parent's validity is checked. */
    now: string;
    resolveVerificationKey: VerificationKeyResolver;
    resolveRevocation: (delegation: AuthorityDelegationV1) => RevocationResolution;
}
export declare function issueSubAuthorityDelegation(parent: AuthorityDelegationV1, body: AuthorityDelegationBodyV1, privateKey: string, options: SubAuthorityIssueOptions): AuthorityDelegationV1;
//# sourceMappingURL=issue.d.ts.map