/**
 * Git Signing Service for the BrightChain identity system.
 *
 * Provides GPG-compatible commit and tag signing using SECP256k1 keys
 * derived from BrightChain member identities. Signatures are produced
 * in a format that Git can verify using the member's exported public key.
 *
 * The service uses ECDSA signing over SHA-256 hashes, wrapped in a
 * PGP-like armored format that Git recognises for signature verification.
 *
 * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5
 */
import { ECIESService, PlatformID } from '@digitaldefiance/ecies-lib';
/**
 * Error thrown when Git signing operations fail.
 */
export declare class GitSigningError extends Error {
    constructor(message: string);
}
/**
 * Result of a Git signing operation.
 */
export interface IGitSignatureResult {
    /** The armored PGP-like signature block */
    armoredSignature: string;
    /** Raw ECDSA signature bytes (DER-encoded, hex) */
    signatureHex: string;
    /** SHA-256 hash of the signed content (hex) */
    contentHashHex: string;
    /** BIP44 derivation path used for the signing key */
    derivationPath: string;
}
/**
 * Result of exporting a public key in PGP-like format.
 */
export interface IGitPublicKeyExport {
    /** Armored PGP-like public key block */
    armoredPublicKey: string;
    /** Compressed SECP256k1 public key (hex) */
    publicKeyHex: string;
    /** BIP44 derivation path */
    derivationPath: string;
    /** Key fingerprint (SHA-256 of the public key, first 20 bytes, hex) */
    fingerprint: string;
}
/**
 * Service for signing Git commits and tags using BrightChain member keys.
 *
 * Produces PGP-armored signatures compatible with `git verify-commit`
 * and `git verify-tag` when the corresponding public key is imported
 * into the user's GPG keyring.
 *
 * All methods are static and stateless.
 *
 * @example
 * ```typescript
 * // Sign a commit
 * const sig = GitSigningService.signCommit(paperKey, commitContent);
 *
 * // Export public key for GPG import
 * const pubKey = GitSigningService.exportPublicKey(paperKey);
 *
 * // Verify a signature
 * const valid = GitSigningService.verify(commitContent, sig, paperKey);
 * ```
 */
export declare class GitSigningService {
    /**
     * Sign a Git commit payload.
     *
     * Produces a PGP-armored ECDSA signature over the SHA-256 hash
     * of the commit content.
     *
     * **Validates: Requirements 7.1, 7.2**
     *
     * @param paperKey      - The 24-word BIP39 mnemonic (private key source)
     * @param commitContent - The raw commit object content to sign
     * @returns The signature result with armored signature block
     * @throws {GitSigningError} If signing fails
     */
    static signCommit(paperKey: string, commitContent: string): IGitSignatureResult;
    /**
     * Sign a Git tag payload.
     *
     * Produces a PGP-armored ECDSA signature over the SHA-256 hash
     * of the tag content.
     *
     * **Validates: Requirements 7.3**
     *
     * @param paperKey   - The 24-word BIP39 mnemonic (private key source)
     * @param tagContent - The raw tag object content to sign
     * @returns The signature result with armored signature block
     * @throws {GitSigningError} If signing fails
     */
    static signTag(paperKey: string, tagContent: string): IGitSignatureResult;
    /**
     * Verify a signature against content using the signer's paper key.
     *
     * Derives the public key from the paper key and verifies the ECDSA
     * signature against the SHA-256 hash of the content.
     *
     * **Validates: Requirements 7.4**
     *
     * @param content   - The original content that was signed
     * @param signature - The signature result to verify
     * @param paperKey  - The signer's paper key (for public key derivation)
     * @returns `true` if the signature is valid
     */
    static verify(content: string, signature: IGitSignatureResult, paperKey: string): boolean;
    /**
     * Verify a signature using a raw public key hex string.
     *
     * @param content      - The original content that was signed
     * @param signature    - The signature result to verify
     * @param publicKeyHex - The signer's compressed public key (hex)
     * @returns `true` if the signature is valid
     */
    static verifyWithPublicKey(content: string, signature: IGitSignatureResult, publicKeyHex: string): boolean;
    /**
     * Export the Git signing public key in a PGP-armored format.
     *
     * The exported key can be added to a GPG keyring or uploaded to
     * GitHub/GitLab for signature verification.
     *
     * **Validates: Requirements 7.5**
     *
     * @param paperKey - The 24-word BIP39 mnemonic
     * @returns The public key export with armored block and fingerprint
     * @throws {GitSigningError} If key derivation fails
     */
    static exportPublicKey(paperKey: string): IGitPublicKeyExport;
    /**
     * Validate a paper key before using it for Git signing.
     *
     * @param paperKey     - The paper key to validate
     * @param eciesService - The ECIES service for validation
     * @returns `true` if the paper key is valid
     */
    static validateKey<TID extends PlatformID = Uint8Array>(paperKey: string, eciesService: ECIESService<TID>): boolean;
    /**
     * Core signing implementation shared by signCommit and signTag.
     */
    private static sign;
}
//# sourceMappingURL=gitSigningService.d.ts.map