export interface AgentIdentityKeyPair {
    publicKeyPem: string;
    privateKeyPem: string;
}
export interface TrustedAgentKey {
    keyId: string;
    publicKeyPem: string;
    agentId?: string;
    expiresAt?: string;
}
export interface AgentSignatureContext {
    method: string;
    url: string;
}
export interface SignAgentAccessHeadersOptions extends AgentSignatureContext {
    privateKeyPem: string;
    keyId: string;
    createdAt?: Date;
}
export interface VerifyAgentAccessHeadersOptions extends AgentSignatureContext {
    trustedKeys: TrustedAgentKey[];
    now?: Date;
    maxSkewMs?: number;
}
export interface AgentSignatureVerification {
    ok: boolean;
    reason: "verified" | "missing_signature" | "unknown_key" | "key_expired" | "agent_mismatch" | "timestamp_skew" | "invalid_signature";
    keyId?: string;
    agentId?: string;
    signatureInputHash?: string;
}
export declare function createAgentIdentityKeyPair(): AgentIdentityKeyPair;
export declare function buildAgentSignatureInput(headers: Headers, context: AgentSignatureContext): {
    protocol: string;
    version: string;
    method: string;
    url: string;
    headers: Record<string, string>;
};
export declare function signAgentAccessHeaders(headers: Headers, options: SignAgentAccessHeadersOptions): Headers;
export declare function verifyAgentAccessHeaders(headers: Headers, options: VerifyAgentAccessHeadersOptions): AgentSignatureVerification;
export declare function parseTrustedAgentKeys(input: unknown): TrustedAgentKey[];
//# sourceMappingURL=index.d.ts.map