import type { AuthorityRevocationBodyV1, AuthorityRevocationV1 } from './types.js';
/** Domain tags for the three preimages this record uses. Each is a distinct APS tag
 *  followed by one zero byte, the same discipline AuthorityDelegationV1 and
 *  PrincipalBindingRevocationV1 follow, so bytes minted for one construction can never
 *  be read as bytes minted for another. */
export declare const AUTHORITY_REVOCATION_ID_DOMAIN = "APS-AUTHORITY-REVOCATION-ID-V1\0";
export declare const AUTHORITY_REVOCATION_SIGNATURE_DOMAIN = "APS-AUTHORITY-REVOCATION-SIGNATURE-V1\0";
export declare const AUTHORITY_REVOCATION_CASCADE_TRANSACTION_DOMAIN = "APS-AUTHORITY-REVOCATION-CASCADE-TRANSACTION-ID-V1\0";
/** The origin content a cascade transaction identity is derived from: the revocation body
 *  with `cascade_transaction_id` absent, alongside `revocation_id` and `signature`.
 *
 *  Section 3.5.1 says a cascade carries a transaction identity shared by every record it
 *  produces, and says nothing about how it is constructed. A content-bound derivation is
 *  chosen over a random value so that issuance stays byte-deterministic for fixed inputs
 *  and so a verifier can recompute the field instead of accepting whatever the issuer
 *  wrote there. Independent cascades do not collide because the origin's 16-byte `nonce`
 *  is inside this preimage. */
export type AuthorityRevocationCascadeOriginV1 = Omit<AuthorityRevocationBodyV1, 'cascade_transaction_id'>;
/** Exact RFC 8785 input used to derive cascade_transaction_id. */
export declare function authorityRevocationCascadeTransactionInput(origin: AuthorityRevocationCascadeOriginV1): string;
export declare function computeAuthorityRevocationCascadeTransactionId(origin: AuthorityRevocationCascadeOriginV1): string;
/** Write-boundary twin of computeAuthorityRevocationCascadeTransactionId(). */
export declare function computeAuthorityRevocationCascadeTransactionIdForWrite(origin: AuthorityRevocationCascadeOriginV1): string;
/** Exact RFC 8785 input used to derive revocation_id. */
export declare function authorityRevocationIdInput(body: AuthorityRevocationBodyV1): string;
export declare function computeAuthorityRevocationId(body: AuthorityRevocationBodyV1): string;
/** Write-boundary twin of computeAuthorityRevocationId().
 *
 *  Emits the same bytes as computeAuthorityRevocationId() for every value it accepts; it
 *  only refuses an integer-valued number outside the interoperable IEEE 754 range rather
 *  than serializing it. Use when ISSUING. verify.ts keeps calling the unrestricted form,
 *  so a record minted before this rule still re-derives its identifier. */
export declare function computeAuthorityRevocationIdForWrite(body: AuthorityRevocationBodyV1): string;
/** Exact Ed25519 input: the signature domain tag plus JCS of the record with `signature`
 *  absent. `revocation_id` IS inside this preimage, so the identifier is signed rather
 *  than being an unauthenticated label beside the signature. */
export declare function authorityRevocationSignatureInput(revocation: Omit<AuthorityRevocationV1, 'signature'>): string;
export declare function signAuthorityRevocation(revocation: Omit<AuthorityRevocationV1, 'signature'>, privateKey: string): string;
export declare function verifyAuthorityRevocationSignature(revocation: AuthorityRevocationV1, publicKey: string): boolean;
/** The body a revocation_id is computed over: the record with `revocation_id` and
 *  `signature` removed. */
export declare function authorityRevocationBody(revocation: AuthorityRevocationV1): AuthorityRevocationBodyV1;
/** The cascade origin a cascade_transaction_id is computed over: the body with
 *  `cascade_transaction_id` removed. */
export declare function authorityRevocationCascadeOrigin(body: AuthorityRevocationBodyV1): AuthorityRevocationCascadeOriginV1;
//# sourceMappingURL=canonical.d.ts.map