/**
 * Sub-agent attenuation. Appends one HMAC link to the chain.
 *
 * HMAC definition from phase 4:
 *
 *     prev_sig_bytes  = invocation.user_sig.sig (first link)
 *                     | previous attenuation's hmac (later links)
 *     hmac_i          = HMAC-SHA256(prev_sig_bytes, utf8(JCS(caveats)))
 *
 * This is the only crypto primitive a sub-agent needs, in any
 * language. The polyglot port (Python, Rust, …) reproduces this
 * function exactly.
 */
import type { Attenuation, AttenuationCaveats } from "./types.js";
/**
 * Compute the HMAC for one attenuation link.
 *
 * @param prevSigBytes raw bytes of the previous link's signature:
 *                     - For the first attenuation, this is the raw
 *                       bytes of `invocation.user_sig.sig` (hex-decoded).
 *                     - For later attenuations, this is the previous
 *                       attenuation's `hmac` (hex-decoded).
 * @param caveats      this attenuation's caveats
 * @returns            32-byte HMAC-SHA256 output
 */
export declare function computeAttenuationHmac(prevSigBytes: Uint8Array, caveats: AttenuationCaveats): Uint8Array;
/**
 * Build a complete `Attenuation` object: compute the HMAC and pair
 * it with the caveats.
 */
export declare function attenuate(prevSigBytes: Uint8Array, caveats: AttenuationCaveats): Attenuation;
/**
 * Convenience: pull the HMAC bytes out of an existing attenuation
 * for use as the `prevSigBytes` of the next link.
 */
export declare function attenuationSigBytes(att: Attenuation): Uint8Array;
//# sourceMappingURL=attenuate.d.ts.map