import { type Signer, type SignerHandle } from './types.js';
/**
 * Backend callback: sign the UTF-8 bytes of `messageUtf8` with key material the
 * backend holds, returning raw 64-byte Ed25519 signature hex (128 chars). The
 * raw private key MUST NOT cross this boundary.
 */
export type RemoteSignFn = (messageUtf8: string) => Promise<string>;
/** Backend callback: return the raw 32-byte Ed25519 public key hex (64 chars). */
export type RemotePublicKeyFn = () => Promise<string>;
export interface HandleSignerOptions {
    handle: SignerHandle;
    signRemote: RemoteSignFn;
    getPublicKeyHex: RemotePublicKeyFn;
    /** Override the default `ed25519:<first-16-hex>` key id (e.g. a KMS key id). */
    keyId?: string;
}
/**
 * Remote Signer over two backend callbacks and a handle. Holds no raw key.
 * Caches the public key on first fetch (it is not secret and is stable for the
 * key's lifetime). The signature returned by the backend is validated at the
 * boundary so a DER-wrapped or wrong-algorithm response is rejected here rather
 * than failing an opaque verify() later.
 */
export declare class HandleSigner implements Signer {
    #private;
    readonly handle: SignerHandle;
    constructor(opts: HandleSignerOptions);
    sign(message: string): Promise<string>;
    publicKeyHex(): Promise<string>;
    keyId(): Promise<string>;
}
/** Convenience constructor matching the existing `from*` adapter ergonomics. */
export declare function createHandleSigner(opts: HandleSignerOptions): Signer;
//# sourceMappingURL=handle-signer.d.ts.map