export { gpgSignatureCovers } from "./signature";
export declare const GPG_SIGNATURE_BEGIN = "-----BEGIN PGP SIGNATURE-----";
export declare const GPG_PUBLIC_KEY_BEGIN = "-----BEGIN PGP PUBLIC KEY BLOCK-----";
/**
 * The terminal command that signs `message`: a detached armored signature plus
 * the exported public key, which is the blob the user pastes back. printf %s adds
 * no newline, so the signed bytes equal `message`. Single quotes are POSIX-escaped
 * so a message cannot break out of the quoting.
 */
export declare function gpgSignCommand(message: string): string;
/** Trim the pasted terminal output and reject it unless it holds both armored blocks. */
export declare function assertGpgSignature(blob: string): string;
export interface GpgSignRequest {
    message: string;
    command: string;
}
export interface GpgSigner {
    readonly family: "gpg";
    /** A GPG identity is the key fingerprint, which only arrives with the signature. */
    readonly address: null;
    readonly capabilities: readonly "signMessage"[];
    /** The request waiting for pasted output, or null. */
    readonly pending: GpgSignRequest | null;
    /**
     * Ask the user to sign `message` in their terminal. Resolves with the pasted
     * armored signature followed by the armored public key, the same blob Keycloak's
     * GPG verifier takes. A second call cancels the first.
     */
    signMessage(message: string): Promise<string>;
    /**
     * Hand pasted output to `request`, the pending request the paste box showed.
     * Throws, and keeps the request pending, when `request` is no longer the
     * pending one, when the paste is incomplete, or when its signature was made
     * over a different message.
     */
    submit(blob: string, request: GpgSignRequest): void;
    cancel(reason?: Error): void;
    subscribe(listener: () => void): () => void;
}
export declare function createGpgSigner(): GpgSigner;
/**
 * Subscribe a component to a GPG signer so it re-renders when a request is
 * parked or settled. Omitted, it is the app-wide signer, so the component that
 * asks for a signature and the one that shows the paste box share one request.
 */
export declare function useGpgSigner(signer?: GpgSigner): GpgSigner;
//# sourceMappingURL=signer.d.ts.map