/**
 * Ed25519 signing-key management for Conarium Receipts.
 *
 * keyId storage: sidecar file next to the key PEM.
 *   private:  /path/audit-ed25519.pem
 *   keyId:    /path/audit-ed25519.pem.keyid   (UTF-8, trimmed single line)
 *   public:   (any path; verify loads path + path+".keyid")
 *
 * Env:
 *   CONARIUM_AUDIT_SIGNING_KEY   — path to Ed25519 private PEM
 *   CONARIUM_AUDIT_KEY_ID        — optional override; else read sidecar
 *   CONARIUM_AUDIT_TRUST_PUBKEYS — comma/semicolon-separated public PEM paths
 *                                  (each needs a sibling `.keyid`); forms the
 *                                  multi-keyId trust store together with the
 *                                  current signing key's derived public key
 *   CONARIUM_ANCHOR_SIGNING_KEY  — same shape, for the countersign service
 *   CONARIUM_ANCHOR_KEY_ID       — optional override; else read sidecar
 */
import { type KeyObject } from 'crypto';
export type KeyId = string;
export interface SigningKey {
    keyId: KeyId;
    privateKey: KeyObject;
}
export interface VerifyKey {
    keyId: KeyId;
    publicKey: KeyObject;
}
export declare function generateKeyPair(keyId: KeyId): {
    privatePem: string;
    publicPem: string;
    keyId: KeyId;
};
/** Write PEMs + .keyid sidecar. Sets 0600 on POSIX for the private key. */
export declare function writeKeyPairFiles(dirBase: string, keyId: KeyId): {
    privatePath: string;
    publicPath: string;
    keyIdPath: string;
    publicKeyIdPath: string;
};
/** POSIX only. win32 modes are meaningless — never fail-closed there. */
export declare function assertPrivateKeyMode(path: string, mode: number, opts?: {
    platform?: NodeJS.Platform;
    allowLoose?: boolean;
}): void;
export declare function loadSigningKeyFrom(path: string, opts?: {
    keyId?: string;
    pathEnv?: string;
    keyIdEnv?: string;
}): SigningKey;
export declare function loadSigningKey(): SigningKey | null;
/** Anchor / countersign key. Unlike the audit loader, missing env is an error. */
export declare function loadAnchorSigningKey(): SigningKey;
export declare function loadVerifyKeys(paths: string[]): VerifyKey[];
export declare function signHash(key: SigningKey, hash: string): string;
export declare function verifyHash(key: VerifyKey, hash: string, signatureBase64: string): boolean;
/** Parse CONARIUM_AUDIT_TRUST_PUBKEYS (`,` or `;` separated). Empty → []. */
export declare function parseTrustPubkeyPaths(envValue?: string | undefined): string[];
/**
 * Trust store for validateChain / rotation:
 * current signing key (derived public) + CONARIUM_AUDIT_TRUST_PUBKEYS.
 * Map is keyed by keyId; later paths override earlier ones for the same id.
 */
export declare function loadTrustStore(signingKey?: SigningKey | null): Map<KeyId, VerifyKey>;
//# sourceMappingURL=keys.d.ts.map