/**
 * Layer-level signers. Phase 1 custodial mode: Hive holds both org
 * and user private keys and signs both layers itself. Phase 2+ moves
 * the user sign step to the user's device; the API stays the same
 * (the caller swaps which key it uses where).
 */
import type { Invocation, InvocationUnsigned, UserAuthorization, UserAuthorizationUnsigned } from "./types.js";
/**
 * Sign a `user_authorization` envelope with a single-key org private
 * key. Custodial phase 1 uses this; phase 3+ uses
 * `signUserAuthorizationMultisig` when the org adopts an m-of-n
 * policy.
 *
 * @param unsigned the layer without `org_sig`
 * @param orgPrivKey 32-byte secp256k1 private key
 */
export declare function signUserAuthorizationSingle(unsigned: UserAuthorizationUnsigned, orgPrivKey: Uint8Array): UserAuthorization;
/**
 * Sign a `user_authorization` envelope under a multisig policy. Each
 * signer is identified by its `key_index` into the policy's `keys`
 * array. Returns the assembled `multisig-v1` envelope. Threshold
 * enforcement happens at verify time.
 *
 * @param unsigned the layer without `org_sig`
 * @param signers  array of { key_index, privKey } — one entry per
 *                 participating signer. Must be sorted by key_index
 *                 ascending so the canonical output is deterministic.
 */
export declare function signUserAuthorizationMultisig(unsigned: UserAuthorizationUnsigned, signers: Array<{
    key_index: number;
    privKey: Uint8Array;
}>): UserAuthorization;
/**
 * Sign an `invocation` envelope with the user's Ed25519 private key.
 *
 * @param unsigned the layer without `user_sig`
 * @param userPrivKey 32-byte Ed25519 private key (seed)
 */
export declare function signInvocation(unsigned: InvocationUnsigned, userPrivKey: Uint8Array): Invocation;
/**
 * Pull the raw signature bytes out of an invocation's `user_sig`,
 * for use as the HMAC key of the first attenuation.
 */
export declare function invocationSigBytes(inv: Invocation): Uint8Array;
//# sourceMappingURL=sign.d.ts.map