import { type TArg, type TRet } from '@noble/hashes/utils.js';
import * as P from 'micro-packed';
/**
 * SSH length-prefixed string coder.
 * @example
 * Encode the SSH string framing used by OpenSSH packets.
 * ```ts
 * import { SSHString } from 'micro-key-producer/ssh.js';
 * SSHString.encode('ssh-ed25519');
 * ```
 */
export declare const SSHString: P.CoderType<string>;
export declare const SSHBuf: TRet<P.CoderType<Uint8Array>>;
/**
 * SSH key-type tag coder for `ssh-ed25519`.
 * @example
 * Encode the fixed OpenSSH key type tag for Ed25519 keys.
 * ```ts
 * import { SSHKeyType } from 'micro-key-producer/ssh.js';
 * SSHKeyType.encode(undefined);
 * ```
 */
export declare const SSHKeyType: P.CoderType<undefined>;
type PublicKeyValue = P.StructInput<{
    keyType: undefined;
    pubKey: Uint8Array;
}>;
export declare const PublicKey: TRet<P.CoderType<PublicKeyValue>>;
type PrivateKeyValue = P.StructInput<{
    check1: Uint8Array;
    check2: Uint8Array;
    keyType: undefined;
    pubKey: Uint8Array;
    privKey: Uint8Array;
    comment: string;
}>;
/**
 * SSH agent user-auth request coder.
 * @example
 * Encode the payload that SSH agents sign during public-key authentication.
 * ```ts
 * import { randomBytes } from '@noble/hashes/utils.js';
 * import { AuthData, getKeys } from 'micro-key-producer/ssh.js';
 * const seed = randomBytes(32);
 * AuthData.encode({
 *   nonce: randomBytes(32),
 *   userAuthRequest: 50,
 *   user: 'alice',
 *   conn: 'ssh-connection',
 *   auth: 'publickey',
 *   haveSig: 1,
 *   pubKey: { pubKey: getKeys(seed).publicKeyBytes },
 * });
 * ```
 */
type AuthDataValue = P.StructInput<{
    nonce: Uint8Array;
    userAuthRequest: number;
    user: string;
    conn: string;
    auth: string;
    haveSig: number;
    keyType: undefined;
    pubKey: P.StructInput<{
        keyType: undefined;
        pubKey: Uint8Array;
    }>;
}>;
/** SSH agent user-auth request coder. */
export declare const AuthData: TRet<P.CoderType<AuthDataValue>>;
/** Decoded SSH agent authentication request. */
export type AuthDataType = P.UnwrapCoder<typeof AuthData>;
/**
 * OpenSSH private-key armor coder.
 * @example
 * Decode the armored private key text that `getKeys()` emits.
 * ```ts
 * import { randomBytes } from '@noble/hashes/utils.js';
 * import { PrivateExport, getKeys } from 'micro-key-producer/ssh.js';
 * const seed = randomBytes(32);
 * PrivateExport.decode(getKeys(seed, 'alice@example.com').privateKey);
 * ```
 */
type PrivateExportValue = P.StructInput<{
    magic: undefined;
    ciphername: undefined;
    kdfname: undefined;
    kdfopts: undefined;
    keys: P.StructInput<{
        pubKey: PublicKeyValue;
        privKey: PrivateKeyValue;
    }>[];
}>;
/** OpenSSH private-key armor coder. */
export declare const PrivateExport: TRet<P.Coder<PrivateExportValue, string>>;
/**
 * Encodes an OpenSSH public key line.
 * @param bytes - Raw ed25519 public key bytes.
 * @param comment - Optional trailing comment.
 * @returns `ssh-ed25519 ...` public key line.
 * @throws If the key blob or one-line comment is invalid. {@link Error}
 * @example
 * Render the OpenSSH public key line you can paste into `authorized_keys`.
 * ```ts
 * import { randomBytes } from '@noble/hashes/utils.js';
 * import { formatPublicKey, getKeys } from 'micro-key-producer/ssh.js';
 * const seed = randomBytes(32);
 * formatPublicKey(getKeys(seed).publicKeyBytes, 'alice@example.com');
 * ```
 */
export declare function formatPublicKey(bytes: TArg<Uint8Array>, comment?: string): string;
/**
 * Computes the OpenSSH SHA-256 fingerprint for a public key.
 * @param bytes - Raw ed25519 public key bytes.
 * @returns SSH fingerprint string.
 * @example
 * Compute the fingerprint shown by `ssh-keygen -l`.
 * ```ts
 * import { randomBytes } from '@noble/hashes/utils.js';
 * import { getFingerprint, getKeys } from 'micro-key-producer/ssh.js';
 * const seed = randomBytes(32);
 * getFingerprint(getKeys(seed).publicKeyBytes);
 * ```
 */
export declare function getFingerprint(bytes: TArg<Uint8Array>): string;
/**
 * Derives deterministic OpenSSH key material from an ed25519 secret key.
 * @param privateKey - 32-byte ed25519 secret key.
 * @param comment - Optional key comment.
 * @param checkBytes - Optional repeated check bytes for the private-key block.
 * @returns Public key bytes, public key text, fingerprint, and armored private key.
 * @throws If the secret key, check bytes, or public-key comment is invalid. {@link Error}
 * @example
 * Export both the public and private OpenSSH key material from one seed.
 * ```ts
 * import { randomBytes } from '@noble/hashes/utils.js';
 * import { getKeys } from 'micro-key-producer/ssh.js';
 * const seed = randomBytes(32);
 * getKeys(seed, 'alice@example.com').privateKey;
 * ```
 */
export declare function getKeys(privateKey: TArg<Uint8Array>, comment?: string, checkBytes?: TArg<Uint8Array>): TRet<{
    publicKeyBytes: Uint8Array;
    publicKey: string;
    fingerprint: string;
    privateKey: string;
}>;
/**
 * Signs SSH agent authentication data with an ed25519 private key.
 * @param privateKey - 32-byte ed25519 secret key.
 * @param data - SSH agent authentication payload.
 * @returns Detached signature bytes.
 * @example
 * Sign the SSH agent payload that will be verified against the exported public key.
 * ```ts
 * import { randomBytes } from '@noble/hashes/utils.js';
 * import { authSign, getKeys } from 'micro-key-producer/ssh.js';
 * const seed = randomBytes(32);
 * const keys = getKeys(seed);
 * authSign(seed, {
 *   nonce: randomBytes(32),
 *   userAuthRequest: 50,
 *   user: 'alice',
 *   conn: 'ssh-connection',
 *   auth: 'publickey',
 *   haveSig: 1,
 *   pubKey: { pubKey: keys.publicKeyBytes },
 * });
 * ```
 */
export declare function authSign(privateKey: TArg<Uint8Array>, data: TArg<AuthDataType>): TRet<Uint8Array>;
export default getKeys;