export interface Ed25519KeyPair {
    /** Raw Ed25519 private key (32 bytes). NEVER log, NEVER persist outside Vault. */
    privateKey: Uint8Array;
    /** Raw Ed25519 public key (32 bytes). Safe to publish. */
    publicKey: Uint8Array;
    /** Lowercase hex SHA-256(publicKey) — the fingerprint stored in the registry. */
    publicKeyFingerprint: string;
}
/**
 * Generate a fresh Ed25519 keypair using the library's vetted CSPRNG path.
 * Equivalent to pyca/cryptography Ed25519PrivateKey.generate().
 */
export declare function generateKeypair(): Ed25519KeyPair;
/** Sign arbitrary bytes with an Ed25519 private key. Returns base64url unpadded. */
export declare function sign(message: Uint8Array, privateKey: Uint8Array): string;
/** Verify a base64url Ed25519 signature against bytes + public key. */
export declare function verify(signatureBase64Url: string, message: Uint8Array, publicKey: Uint8Array): boolean;
/** UUID4 helper (re-exported so call sites import one place). */
export declare function newUuid(): string;
/**
 * Canonical JSON serialization for signing. Sorts object keys at EVERY depth
 * (not just top level) and preserves array element order.
 *
 * SECURITY: a previous version used `JSON.stringify(obj, Object.keys(obj).sort())`
 * which filters keys at every depth via the replacer-array. That stripped nested
 * object content from the signed payload — mutating `authorized_scope.write_data`
 * would not change the signed bytes, so tampered passports verified successfully.
 * This implementation walks the tree and serializes deterministically.
 */
export declare function canonicalJson(value: unknown): string;
//# sourceMappingURL=ed25519.d.ts.map