import type { AuthorityBoundFulfilment, AuthorityBoundFulfilmentBody, AuthorityExhaustion, AuthorityExhaustionBody } from './types.js';
/** Domain tags. Each is a distinct tag followed by one zero byte, the same discipline
 *  `AuthorityDelegationV1` and `AuthorityRevocationV1` follow, so bytes minted for one
 *  construction can never be read as bytes minted for another. The `PROPOSED-` prefix is
 *  part of the tag: if any of this is ever specified, the specified construction will use a
 *  different tag and records minted under this one will not verify under it. That is the
 *  intended behaviour, not a migration problem to solve later. */
export declare const AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN = "PROPOSED-APS-AUTHORITY-BOUND-FULFILMENT-SIGNATURE-V0\0";
export declare const AUTHORITY_EXHAUSTION_ID_DOMAIN = "PROPOSED-APS-AUTHORITY-EXHAUSTION-ID-V0\0";
export declare const AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN = "PROPOSED-APS-AUTHORITY-EXHAUSTION-SIGNATURE-V0\0";
/** Exact Ed25519 preimage for a fulfilment attestation: the domain tag plus RFC 8785 JCS of
 *  the record with `signature` absent. */
export declare function authorityBoundFulfilmentSignatureInput(body: AuthorityBoundFulfilmentBody): string;
/** Write-boundary twin. Use when ISSUING. The verification path keeps calling the
 *  unrestricted form, so a record minted before the write rule still verifies. */
export declare function authorityBoundFulfilmentSignatureInputForWrite(body: AuthorityBoundFulfilmentBody): string;
export declare function signAuthorityBoundFulfilment(body: AuthorityBoundFulfilmentBody, privateKeyHex: string): string;
export declare function verifyAuthorityBoundFulfilmentSignature(record: AuthorityBoundFulfilment, publicKeyHex: string): boolean;
/** Exact preimage for `exhaustion_id`: the ID domain tag plus JCS of the body. */
export declare function authorityExhaustionIdInput(body: AuthorityExhaustionBody): string;
export declare function computeAuthorityExhaustionId(body: AuthorityExhaustionBody): string;
export declare function computeAuthorityExhaustionIdForWrite(body: AuthorityExhaustionBody): string;
/** Exact Ed25519 preimage for the exhaustion record: the signature domain tag plus JCS of
 *  the record with `signature` absent. `exhaustion_id` IS inside this preimage, so the
 *  identifier is signed rather than being an unauthenticated label beside the signature. */
export declare function authorityExhaustionSignatureInput(record: Omit<AuthorityExhaustion, 'signature'>): string;
export declare function authorityExhaustionSignatureInputForWrite(record: Omit<AuthorityExhaustion, 'signature'>): string;
export declare function signAuthorityExhaustion(record: Omit<AuthorityExhaustion, 'signature'>, privateKeyHex: string): string;
export declare function verifyAuthorityExhaustionSignature(record: AuthorityExhaustion, publicKeyHex: string): boolean;
//# sourceMappingURL=canonical.d.ts.map