/**
 * Long-term identity keys for one fetchproxy MCP server. Persisted on
 * disk (chmod 0600) so the extension's trust record — keyed off the
 * SHA-256 of `x25519Pub` — survives process restarts.
 */
export interface Identity {
    x25519Priv: Uint8Array;
    x25519Pub: Uint8Array;
    ed25519Priv: Uint8Array;
    ed25519Pub: Uint8Array;
    createdAt: number;
}
/** `$HOME/.fetchproxy/identity`. Override via the `dir` arg or `identityDir`. */
export declare function defaultIdentityDir(): string;
/**
 * The filename stem for `serverName`, rejecting anything that could escape the
 * identity directory. Scoped packages (`@fetchproxy/example-mcp`) are legal and
 * get their `/` translated to `_` — which means the stem is NOT a round-trip of
 * the server name, so callers that hold a stem must not feed it back in here.
 */
export declare function safeIdentityFileBase(serverName: string): string;
/**
 * Read the identity for `serverName` from `dir`, generating + persisting
 * a fresh X25519/Ed25519 keypair if no file exists. The file is written
 * with mode 0o600 (single-user only). Callers must use a safe
 * `serverName` — scoped packages like `@fetchproxy/example-mcp` are OK
 * and get their `/` translated to `_` for the filename.
 */
export declare function loadOrCreateIdentity(serverName: string, dir?: string): Promise<Identity>;