import { importJWK, type JWK } from 'jose';
type ImportedKey = Awaited<ReturnType<typeof importJWK>>;
export declare const DEFAULT_SIGNING_KEY_PATH = "/etc/skillera/authz/signing-key.jwk.json";
export declare const SIGNING_KEY_ENV = "AUTHZ_SIGNING_KEY_JWK";
export declare const SIGNING_KEY_PATH_ENV = "AUTHZ_SIGNING_KEY_PATH";
export interface LoadedSigningKey {
    key: ImportedKey;
    kid: string;
}
/** Load the private signing key. Throws (fail-closed) if absent/corrupt. */
export declare function loadSigningKey(opts?: {
    path?: string;
    envVar?: string;
}): Promise<LoadedSigningKey>;
/**
 * Generate an Ed25519 keypair as JWKs (DEC-S2.2). Used by the rotation script
 * (packages/authz/scripts/rotate.ts) and tests. `kid` convention: timestamped.
 */
export declare function generateSigningKeyPair(kid: string): Promise<{
    privateJwk: JWK;
    publicJwk: JWK;
}>;
export {};
//# sourceMappingURL=key-loader.d.ts.map