import type { BehavioralDriftWindowEnvelope, UnsignedBehavioralDriftWindowEnvelope } from './types.js';
/**
 * Canonicalize an envelope for signing. The signature field is set to the
 * empty string before serialization so that signing and verification
 * agree on the bytes-under-signature without either side rebuilding the
 * envelope from a partial shape.
 */
export declare function canonicalizeForSignature(envelope: UnsignedBehavioralDriftWindowEnvelope | BehavioralDriftWindowEnvelope): string;
/** Write-boundary twin of canonicalizeForSignature().
 *
 *  Emits the same bytes as canonicalizeForSignature() for every value it accepts. The only difference
 *  is that an integer-valued number outside the interoperable IEEE 754 range is
 *  refused instead of serialized. Use at signing and new-write boundaries ONLY:
 *  canonicalizeForSignature() stays unrestricted so an artifact signed before this rule keeps
 *  verifying. */
export declare function canonicalizeForSignatureForWrite(envelope: UnsignedBehavioralDriftWindowEnvelope | BehavioralDriftWindowEnvelope): string;
/**
 * Sign an unsigned envelope with the observer's Ed25519 private key
 * (hex). Derives the public key from the private key and writes it into
 * `observer_id` on the returned envelope; this guarantees that the
 * embedded `observer_id` matches the signing key, which the verifier
 * checks against.
 *
 * If the caller provides their own `observer_id` on the input, this
 * helper still derives the public key from the private key and
 * overwrites the field, because a divergence between the embedded
 * observer_id and the signing key is always a bug. The `subject_agent_id`
 * field is passed through unchanged; for self-attestation, the caller
 * sets subject_agent_id to the same value as the derived observer_id.
 */
export declare function signBehavioralDriftWindow(privateKeyHex: string, unsigned: UnsignedBehavioralDriftWindowEnvelope): BehavioralDriftWindowEnvelope;
//# sourceMappingURL=envelope.d.ts.map