import type { JsonWebKey } from 'node:crypto';
/**
 * Generates a P-256 session key pair for the signed-session flow.
 *
 * Returns the compressed public-key hex (bind it into the Dynamic JWT via the
 * `x-dyn-session-public-key` header when you sign in) and the private JWK.
 *
 * Stateless and custody-agnostic: the SDK does NOT persist the key. YOU store
 * `privateKeyJwk` wherever you keep secrets. The returned JWK is extractable
 * (so it can be handed back to you) and is therefore a convenience path, not a
 * security boundary — if you need a non-extractable key (so a host/operator
 * cannot exfiltrate it), generate it in a KMS/HSM/enclave instead and supply a
 * `getSessionSignature` that signs there.
 */
export declare function generateSessionKeyPair(): Promise<{
    publicKeyHex: string;
    privateKeyJwk: JsonWebKey;
}>;
/**
 * Signs a message with a P-256 session private JWK using the exact encoding the
 * keyshares relay expects: ECDSA P-256 / SHA-256 over UTF-8(message), raw r‖s
 * (64 bytes), lowercase hex. Use it to implement `getSessionSignature`:
 *   getSessionSignature: (message) => signSessionMessage(message, privateKeyJwk)
 * The JWK is imported non-extractable for signing.
 */
export declare function signSessionMessage(message: string, privateKeyJwk: JsonWebKey): Promise<string>;
//# sourceMappingURL=sessionKeys.d.ts.map