/**
 * Signed Manifest Push (W2.x infrastructure of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
 *
 * Customer-side signs the discovered AgentManifest with their org private
 * key. Server-side verifies the signature against the registered org
 * public key before accepting the push. Honors Invariant 10 (push-only):
 * we never reach into customer infrastructure, and we only accept pushes
 * that cryptographically prove which org they came from.
 *
 * Signing scheme:
 *   - Algorithm: Ed25519 (small keys, fast verify, deterministic, well-supported in node:crypto).
 *   - Canonical JSON serialisation of the manifest payload (stable key
 *     ordering) prevents signature mismatches due to JSON whitespace or
 *     key-order differences across SDKs.
 *   - Signature is base64url-encoded for transit.
 *
 * Replay protection:
 *   - Payload carries `nonce` (random 16 bytes hex) + `issuedAt` (ISO 8601).
 *   - Server-side verification checks issuedAt is within MAX_AGE_SECONDS
 *     of "now". Replays older than that are rejected.
 *
 * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-DISCOVERY-CLI (push transport)
 */
import * as crypto from 'node:crypto';
import type { AgentManifest } from './owasp-agentic-scanner.js';
/** Maximum age of a signed push, in seconds. 5 minutes by default. */
export declare const DEFAULT_MAX_AGE_SECONDS = 300;
export interface SignedManifestPayload {
    orgId: string;
    manifest: AgentManifest;
    /** Random hex nonce — 32 chars (16 bytes). */
    nonce: string;
    /** ISO 8601 issue time. */
    issuedAt: string;
}
export interface SignedManifest {
    payload: SignedManifestPayload;
    /** Base64url Ed25519 signature over the canonical JSON of payload. */
    signature: string;
    /** Algorithm tag for forward compat. */
    alg: 'ed25519';
}
export interface KeyPair {
    publicKey: crypto.KeyObject;
    privateKey: crypto.KeyObject;
}
export declare class ManifestSignatureError extends Error {
    readonly code: 'INVALID_SIGNATURE' | 'EXPIRED' | 'MALFORMED' | 'ORG_MISMATCH';
    constructor(code: ManifestSignatureError['code'], message: string);
}
/**
 * Generate a new Ed25519 keypair. Customer runs this ONCE per org and
 * uploads the public key to us; the private key stays on their side.
 */
export declare function generateOrgKeyPair(): KeyPair;
/** Export public key as base64url DER for transit / dashboard storage. */
export declare function exportPublicKey(publicKey: crypto.KeyObject): string;
/** Import a previously-exported base64url DER public key. */
export declare function importPublicKey(b64url: string): crypto.KeyObject;
export declare function signManifest(manifest: AgentManifest, orgId: string, privateKey: crypto.KeyObject, options?: {
    nowMs?: number;
}): SignedManifest;
export interface VerifyOptions {
    /** Expected orgId — mismatch with payload.orgId is rejected. */
    expectedOrgId: string;
    /** Override "now" for tests. Defaults to Date.now(). */
    nowMs?: number;
    /** Max age in seconds (default 5 minutes). */
    maxAgeSeconds?: number;
}
/**
 * Verify a signed manifest against an org public key.
 *
 * Throws ManifestSignatureError on:
 *   - bad signature (INVALID_SIGNATURE)
 *   - payload older than max-age window (EXPIRED)
 *   - malformed payload (MALFORMED)
 *   - payload.orgId !== expectedOrgId (ORG_MISMATCH)
 */
export declare function verifySignedManifest(signed: SignedManifest, publicKey: crypto.KeyObject, options: VerifyOptions): SignedManifestPayload;
//# sourceMappingURL=signed-manifest.d.ts.map