/**
 * Request signing — session-bound ECDSA (strategy step 3: "sign + nonce +
 * timestamp the payload... stop replay of a known-good vector").
 *
 * The site API key is public (it ships in browser JS on every customer's
 * page), and any symmetric secret delivered to JavaScript is retrievable by
 * the client. The browser therefore creates a non-exportable ECDSA P-256
 * private key and registers only the public JWK with the backend. Every
 * /api/predict call is signed with the private CryptoKey plus a nonce and
 * timestamp the server checks for freshness and single use.
 *
 * Uses the Web Crypto API (crypto.subtle), which requires a secure context
 * (HTTPS or localhost). If unavailable, signing is skipped entirely and the
 * request is sent unsigned — the backend's soft-enforcement mode accepts
 * that (see request_signing.py's REQUEST_SIGNING_MODE), so an unsupported
 * environment degrades gracefully in backend soft-enforcement mode.
 */
export interface SignedEnvelope {
    nonce: string;
    timestamp: number;
    signature: string;
}
/** Public key registered with /api/signing/register. The private key never
 * leaves the browser's non-exportable CryptoKey. */
export declare function getSigningPublicKey(sessionId: string): Promise<JsonWebKey | null>;
/** 32 hex chars (128 bits) of cryptographic randomness, unique per request. */
export declare function generateNonce(): string | null;
/**
 * Sign `bodyString` — the exact string about to be sent as the HTTP request
 * body — with the browser's non-exportable per-session private key. Signing
 * the literal outgoing string (rather than
 * re-deriving a "canonical" form on each side) avoids any risk of a
 * cross-language JSON re-serialization mismatch, the same approach webhook
 * signature schemes (Stripe/GitHub/Slack) use.
 *
 * Returns null if Web Crypto is unavailable, no secret is available, or
 * signing fails for any reason — callers must treat null as "send
 * unsigned," never as an error that should block getting a decision.
 */
export declare function signRequest(sessionId: string, bodyString: string): Promise<SignedEnvelope | null>;
//# sourceMappingURL=signing.d.ts.map