import type { A2aAgentCard } from './a2a.js';
/** An algorithm a card is signed with, as JWS names it. */
export type A2aSignatureAlgorithm = 'ES256' | 'ES384' | 'ES512' | 'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512' | 'EdDSA' | 'Ed25519';
/** A JSON Web Key, as Web Crypto imports and exports one. */
export interface A2aJsonWebKey {
    /** The key type: `EC`, `RSA`, or `OKP`. */
    kty: string;
    /** The algorithm it is for, when it says. */
    alg?: string;
    /** Anything else the key holds: its curve, its public and private parts. */
    [field: string]: unknown;
}
/** A Web Crypto key, as `crypto.subtle` returns one. Any runtime's `CryptoKey` is one. */
export interface A2aCryptoKey {
    /** Its algorithm. */
    readonly algorithm: unknown;
    /** What it may do. */
    readonly usages: readonly string[];
}
/** A key that signs cards: the private key, its algorithm, and the id a verifier finds its public key by. */
export interface A2aCardSigner {
    /** The private key: a Web Crypto key, or a JWK. */
    key: A2aCryptoKey | A2aJsonWebKey;
    /** Its algorithm. */
    alg: A2aSignatureAlgorithm;
    /** The key's id, which a verifier looks its public key up by. */
    kid: string;
    /** A URL of the JWK Set that holds the public key, for a verifier that fetches it. */
    jku?: string;
    /** Unprotected header values, written beside the signature and not covered by it. */
    header?: Record<string, unknown>;
}
/**
 * Finds the public key a signature names: by its key id, the JWK Set URL its header gives, if any,
 * and the algorithm it was made with. `undefined` for a key it does not trust.
 */
export type A2aCardKeyResolver = (kid: string, jku: string | undefined, alg: A2aSignatureAlgorithm) => A2aCryptoKey | A2aJsonWebKey | undefined | Promise<A2aCryptoKey | A2aJsonWebKey | undefined>;
/** Raised for a card that carries no signature its verifier can check, or none that holds. */
export declare class A2aCardSignatureError extends Error {
    /** Why each signature the card carries did not hold, in its order. */
    readonly reasons: readonly string[];
    constructor(message: string, 
    /** Why each signature the card carries did not hold, in its order. */
    reasons?: readonly string[]);
}
/**
 * A card in the form its signatures cover: as its schema has it, fields the schema does not name and
 * fields at their default left out, then the `signatures` field and every empty value, and serialized
 * with each object's keys in order, as RFC 8785 serializes JSON.
 */
export declare function canonicalA2aCard(card: A2aAgentCard | Omit<A2aAgentCard, 'signatures'>): string;
/**
 * The card with one more signature, by `signer`, over its canonical form: a flattened JWS whose
 * protected header names the algorithm, the key id, `typ: JOSE`, and the key set's URL when given.
 */
export declare function signA2aCard(card: A2aAgentCard, signer: A2aCardSigner): Promise<A2aAgentCard>;
/**
 * Checks a card's signatures over its canonical form, each against the public key `resolveKey` gives
 * for its key id, and returns the first that holds. Throws `A2aCardSignatureError` for a card with no
 * signature, or none that holds, saying why each did not.
 */
export declare function verifyA2aCard(card: A2aAgentCard, resolveKey: A2aCardKeyResolver): Promise<{
    kid: string;
    alg: A2aSignatureAlgorithm;
}>;