/**
 * Ed25519 Signing and Verification for Attestations
 *
 * Implements §4.2-4.4 of the RecourseOS Attestation Protocol.
 * Uses Node.js crypto module for Ed25519 operations.
 */
import { KeyObject } from 'crypto';
import { KeyMetadata } from './key-management.js';
/**
 * Error thrown when signing or verification fails
 */
export declare class AttestationSigningError extends Error {
    constructor(message: string);
}
/**
 * Base64url encode (RFC 4648 Section 5, no padding)
 */
export declare function base64urlEncode(buffer: Buffer): string;
/**
 * Base64url decode (RFC 4648 Section 5)
 */
export declare function base64urlDecode(str: string): Buffer;
/**
 * Attestation content fields (signed payload excludes signature and attestation_uri for ID derivation)
 */
export interface AttestationContent {
    input: unknown;
    output: unknown;
    evaluator: string;
    timestamp: string;
    key_id: string;
}
/**
 * Full attestation structure
 */
export interface Attestation extends AttestationContent {
    attestation_uri: string;
    signature: string;
}
/**
 * Generate an Ed25519 keypair
 *
 * @returns Object containing private and public key in various formats
 */
export declare function generateKeyPair(): {
    privateKey: KeyObject;
    publicKey: KeyObject;
    publicKeyBase64url: string;
};
/**
 * Derive attestation ID from content fields per §6.3
 *
 * The attestation_id is derived from: input, output, evaluator, timestamp, key_id
 * Excludes: signature, attestation_uri (to avoid circularity)
 *
 * @param content - The attestation content fields
 * @returns 32-character lowercase hex string
 */
export declare function deriveAttestationId(content: AttestationContent): string;
/**
 * Construct attestation URI from instance base URL and attestation ID
 */
export declare function constructAttestationUri(instanceBaseUrl: string, attestationId: string): string;
/**
 * Construct the signed payload from an attestation (all fields except signature)
 *
 * Per §4.1: The signed payload consists of all attestation fields except signature.
 * The attestation_uri IS included in the signed payload.
 */
export declare function constructSignedPayload(attestation: Omit<Attestation, 'signature'>): string;
/**
 * Sign an attestation per §4.3
 *
 * @param content - The attestation content fields
 * @param privateKey - The Ed25519 private key
 * @param keyMetadata - Metadata about the signing key (must be active)
 * @param instanceBaseUrl - Base URL for constructing attestation_uri
 * @returns Complete signed attestation
 */
export declare function signAttestation(content: AttestationContent, privateKey: KeyObject, keyMetadata: KeyMetadata, instanceBaseUrl: string): Attestation;
/**
 * Verification result
 */
export type VerificationResult = {
    valid: true;
} | {
    valid: false;
    reason: string;
};
/**
 * Verify an attestation signature per §4.4
 *
 * @param attestation - The attestation to verify
 * @param publicKeyBase64url - The base64url-encoded public key
 * @param keyMetadata - Metadata about the key (must be verifiable state)
 * @returns Verification result
 */
export declare function verifyAttestation(attestation: Attestation, publicKeyBase64url: string, keyMetadata: KeyMetadata): VerificationResult;
/**
 * Verify attestation ID matches content
 *
 * Use this to check that an attestation_uri corresponds to the actual content.
 */
export declare function verifyAttestationId(attestation: Attestation): boolean;
/**
 * Create a complete attestation (convenience function)
 *
 * This combines content creation, ID derivation, URI construction, and signing.
 */
export declare function createAttestation(input: unknown, output: unknown, evaluator: string, privateKey: KeyObject, keyMetadata: KeyMetadata, instanceBaseUrl: string): Attestation;
//# sourceMappingURL=signing.d.ts.map