import type { FilesystemMode, InstructionFile, InstructionProvenanceReceipt } from './types.js';
/** Typed error for path-canonicalization rejections (spec §5.1). */
export declare class IPRPathError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
export interface CanonicalizePathOptions {
    /** Absolute POSIX path to the working root. The input path must resolve
     *  inside this root. */
    workingRoot: string;
    /** Filesystem case mode for the working root. Affects normalization. */
    filesystemMode: FilesystemMode;
}
/**
 * Canonicalize a raw path per spec §5.1. Returns a relative POSIX path.
 *
 * Steps (must match the spec algorithm exactly for cross-language parity):
 *   1. Reject empty path.
 *   2. Reject percent-encoded paths (paths are POSIX, not URIs).
 *   3. Compute absolute form of `raw` relative to `workingRoot` (without
 *      filesystem access — pure string math).
 *   4. Reject if the absolute form does not start with `workingRoot`.
 *   5. Strip the working-root prefix to get a relative form.
 *   6. Reject leading `./`.
 *   7. Reject any `..` segment.
 *   8. Reject trailing slash.
 *   9. Normalize Unicode to NFC.
 *  10. Apply case mode (lowercase if case-insensitive).
 *  11. Replace OS-specific separators with `/`.
 */
export declare function canonicalizePath(raw: string, options: CanonicalizePathOptions): string;
/** sha256 hex of a UTF-8 string. */
export declare function sha256Hex(input: string | Uint8Array): string;
/**
 * Compute `context_root` per spec §4.1: sha256 of the JCS canonicalization
 * of the `instruction_files` array. Must be byte-identical across languages.
 */
export declare function computeContextRoot(files: InstructionFile[]): string;
/** Write-boundary twin of computeContextRoot().
 *
 *  Emits the same bytes as computeContextRoot() for every value it accepts. The only difference
 *  is that an integer-valued number outside the interoperable IEEE 754 range is
 *  refused instead of serialized. Use at signing and new-write boundaries ONLY:
 *  computeContextRoot() stays unrestricted so an artifact signed before this rule keeps
 *  verifying. */
export declare function computeContextRootForWrite(files: InstructionFile[]): string;
/**
 * Canonical sort order for `instruction_files`: lexicographic by `path`
 * (canonical bytes). Spec §6.3 step 8.
 */
export declare function sortInstructionFiles(files: InstructionFile[]): InstructionFile[];
export declare function canonicalizeEnvelope(envelope: Omit<InstructionProvenanceReceipt, 'signature' | 'receipt_id'>): string;
/** Write-boundary twin of canonicalizeEnvelope().
 *
 *  Shares one implementation body with canonicalizeEnvelope() so the two can never drift apart
 *  on the field list. Emits the same bytes for every value it accepts; the only
 *  difference is that an integer-valued number outside the interoperable IEEE 754
 *  range is refused instead of serialized. Use at signing and new-write boundaries
 *  ONLY: canonicalizeEnvelope() stays unrestricted so an artifact signed before this rule keeps
 *  verifying. */
export declare function canonicalizeEnvelopeForWrite(envelope: Omit<InstructionProvenanceReceipt, 'signature' | 'receipt_id'>): string;
//# sourceMappingURL=canonicalize.d.ts.map