/**
 * CLEO signing identity — adapter over `llmtxt/identity` for audit-trail signing.
 *
 * This module owns the CLEO-specific persistence of an Ed25519 keypair used to
 * sign `.cleo/audit/*.jsonl` entries and `cleo bug` severity attestations. It
 * reuses every cryptographic primitive from {@link module:llmtxt/identity} so
 * there is **zero duplication of signing primitives** (T947 Constraint #4).
 *
 * ## Key storage
 *
 * Unlike `llmtxt/identity` (which persists to `~/.llmtxt/identity.key`), the
 * CLEO identity persists to the **project's** `.cleo/keys/cleo-identity.json`
 * so each project has its own signing key by default. This prevents a single
 * compromised key from invalidating audit trails across unrelated projects.
 *
 * - File path: `<projectRoot>/.cleo/keys/cleo-identity.json`
 * - File mode: `0o600` (owner read/write only) — enforced programmatically.
 * - File format: `{ "sk": "<64-char hex>", "pk": "<64-char hex>" }`
 *
 * ## Deterministic dev/test mode
 *
 * When `CLEO_IDENTITY_SEED` env var is set to a 64-char hex string, the
 * identity is derived deterministically from that seed and **not persisted**.
 * This is intended for test harnesses and reproducible CI signing.
 *
 * @task T947
 * @adr ADR-054 (draft)
 * @see {@link module:llmtxt/identity}
 */
import { AgentIdentity } from 'llmtxt/identity';
/**
 * Re-export the {@link AgentIdentity} class so callers can import everything
 * identity-related from `@cleocode/core/identity` without reaching into the
 * `llmtxt` subpath directly.
 */
export { AgentIdentity };
/**
 * On-disk shape of `.cleo/keys/cleo-identity.json`.
 *
 * Both `sk` (secret key seed) and `pk` (public key) are 64-char lowercase
 * hexadecimal strings. The secret key MUST be treated as sensitive data —
 * never log it, never commit it, and always store the file with mode `0o600`.
 *
 * @task T947
 */
export interface CleoIdentityFile {
    /** 64-char lowercase hex of the 32-byte Ed25519 secret key seed. */
    sk: string;
    /** 64-char lowercase hex of the 32-byte Ed25519 public key. */
    pk: string;
}
/**
 * Signed audit envelope attached to a JSONL line.
 *
 * The `sig` field is a 128-char lowercase hex encoding of the 64-byte Ed25519
 * signature over the UTF-8 bytes of the unsigned canonical JSON line.
 * The `pub` field is the 64-char lowercase hex public key used to verify it.
 *
 * @task T947
 */
export interface AuditSignature {
    /** Hex-encoded 64-byte Ed25519 signature (128 chars). */
    sig: string;
    /** Hex-encoded 32-byte Ed25519 public key (64 chars). */
    pub: string;
}
/**
 * Resolve the absolute path to the CLEO identity key file.
 *
 * @param cwd - Optional working directory; defaults to `process.cwd()`.
 * @returns Absolute path to `<projectRoot>/.cleo/keys/cleo-identity.json`.
 *
 * @task T947
 */
export declare function getCleoIdentityPath(cwd?: string): string;
/**
 * Load-or-generate the persistent CLEO signing identity.
 *
 * Resolution order:
 * 1. `CLEO_IDENTITY_SEED` env var (64-char hex) → derive deterministically,
 *    do NOT persist. Intended for tests and CI.
 * 2. Persisted file at `<cleoDir>/keys/cleo-identity.json` → load.
 * 3. No file present → generate a fresh keypair and persist it with mode 0600.
 *
 * @param cwd - Optional working directory for project-root resolution.
 * @returns A ready-to-use {@link AgentIdentity}.
 *
 * @example
 * ```ts
 * const id = await getCleoIdentity();
 * const { signature, pubkey } = await signAuditLine(id, lineJson);
 * ```
 *
 * @task T947
 */
export declare function getCleoIdentity(cwd?: string): Promise<AgentIdentity>;
/**
 * Sign an audit JSONL line with the supplied identity.
 *
 * The canonical bytes are the UTF-8 encoding of the raw `line` string (with
 * no trailing newline). Callers MUST pass the exact line they intend to
 * persist — the verifier re-hashes the same bytes.
 *
 * @param identity - CLEO signing identity (from {@link getCleoIdentity}).
 * @param line - JSONL line to sign (no trailing newline).
 * @returns Hex-encoded signature and pubkey.
 *
 * @task T947
 */
export declare function signAuditLine(identity: AgentIdentity, line: string): Promise<AuditSignature>;
/**
 * Verify an audit line's signature against a given pubkey.
 *
 * @param line - The original JSONL line that was signed (no trailing newline).
 * @param signature - Hex-encoded 64-byte Ed25519 signature.
 * @param pubkey - Hex-encoded 32-byte Ed25519 public key.
 * @returns `true` iff the signature is valid for (line, pubkey).
 *
 * @task T947
 */
export declare function verifyAuditLine(line: string, signature: string, pubkey: string): Promise<boolean>;
//# sourceMappingURL=cleo-identity.d.ts.map