import { DecryptTransform } from './decrypt_transform.ts';
import { EncryptTransform } from './encrypt_transform.ts';
export declare const RsaSignatureFlag: {
    readonly DEFAULT: 0;
    readonly SSH_AGENT_RSA_SHA2_256: 2;
    readonly SSH_AGENT_RSA_SHA2_512: 4;
};
type RsaSignatureFlag = (typeof RsaSignatureFlag)[keyof typeof RsaSignatureFlag];
export interface SSHKey {
    /** E.g. "ssh-rsa" */
    type: string;
    /** Base64-encoded public key blob */
    key: string;
    /** Human-readable comment, typically the key file path */
    comment: string;
    /** Raw binary key blob — required by sign() */
    raw: Buffer;
}
export interface SSHSignature {
    /** E.g. "ssh-rsa" */
    type: string;
    /** Base64-encoded signature */
    signature: string;
    /** Raw binary signature */
    raw: Buffer;
}
export interface SSHAgentClientOptions {
    timeout?: number;
    sockFile?: string;
    cipherAlgo?: string;
    digestAlgo?: string;
    /** RSA signature method flag for signing request when using RSA keys */
    rsaSignatureFlag?: RsaSignatureFlag;
}
export declare class SSHAgentClient {
    private readonly timeout;
    private readonly sockFile;
    private readonly cipherAlgo;
    private readonly digestAlgo;
    private readonly rsaSignatureFlag;
    /**
     * @param options - Optional configuration.
     * @throws {Error} if SSH_AUTH_SOCK is not set or socket not found.
     */
    constructor(options?: SSHAgentClientOptions);
    /**
     * Find an SSH key
     *
     * @param selector - (partially) matching an SSH key comment or pubkey
     */
    getIdentity(selector: string): Promise<SSHKey | undefined>;
    /**
     * List all SSH identities available from the agent.
     *
     * Resolves with an array of key objects:
     * ```ts
     * { type: "ssh-rsa", ssh_key: "<base64>", comment: "~/.ssh/id_rsa", raw: Buffer }
     * ```
     */
    getIdentities(): Promise<SSHKey[]>;
    /**
     * Ask the SSH agent to sign `data` with the given `key`.
     *
     * `key` must come from {@link getIdentities} or {@link getIdentity}.
     *
     * Resolves with:
     * ```ts
     * { type: "ssh-rsa", signature: "<base64>", raw: Buffer }
     * ```
     */
    sign(key: SSHKey, data: Buffer): Promise<SSHSignature>;
    /**
     * Verify an SSH signature against a message and public key.
     *
     * No SSH agent communication is required — this is a local crypto operation.
     *
     * @param signature - The signature to verify (from {@link sign}).
     * @param key - The SSH public key (from {@link getIdentities} or {@link getIdentity}).
     * @param data - The original message that was signed.
     * @returns `true` if the signature is valid, `false` otherwise.
     * @throws {Error} if the key type or signature type is unsupported.
     */
    static verify(signature: SSHSignature, key: SSHKey, data: Buffer): boolean;
    /**
     * Encrypt data with given `SSHKey` and `seed` string, using SSH signature as the encryption key.
     *
     * Resolves with a string containing the IV and encrypted data, encoded in `outputEncoding` (default: "hex").
     * The IV is needed for decryption and is included in the output as a prefix to the encrypted data.
     */
    encrypt(key: SSHKey, seed: string, data: NodeJS.ArrayBufferView, outputEncoding?: BufferEncoding): Promise<string>;
    /**
     * Get a Transform stream that encrypts data with given `SSHKey` and `seed` string, using SSH signature as
     * the encryption key.
     *
     * The Transform stream outputs plain binary or a string encoded in `outputEncoding`.
     * The IV is needed for decryption and is included in the output as a prefix to the encrypted data.
     */
    getEncryptTransform(key: SSHKey, seed: string, outputEncoding?: BufferEncoding): Promise<EncryptTransform>;
    /**
     * Decrypt data with given `SSHKey` and `seed` string, using SSH signature as the decryption key.
     *
     * Resolves with a Buffer containing the decrypted data.
     * The IV is needed for decryption and should be included in the input as a prefix to the encrypted data.
     */
    decrypt(key: SSHKey, seed: string, data: string, inputEncoding?: BufferEncoding): Promise<Buffer>;
    /**
     * Get a Transform stream that decrypts data with given `SSHKey` and `seed` string, using SSH signature as
     * the decryption key.
     *
     * The Transform stream expects encrypted data (as plain binary or a string encoded in `inputEncoding`) and
     * outputs a Buffer containing the decrypted data.
     * The IV is needed for decryption and should be included in the input as a prefix to the encrypted data.
     */
    getDecryptTransform(key: SSHKey, seed: string, inputEncoding?: BufferEncoding): Promise<DecryptTransform>;
    private getCipherIV;
    private getCipherKey;
    /**
     * Open a Unix socket to the agent, write a request, and read exactly one
     * response frame. Validates the frame length and message type before handing
     * the payload to `parseResponse`.
     */
    private request;
}
export {};