/**
 * Local AAuth signer (`~/.neotoma/aauth/`).
 *
 * Mirrors `services/agent-site/netlify/lib/aauth_signer.ts` but sources the
 * private JWK from a keypair on disk at `~/.neotoma/aauth/private.jwk`.
 * Used by:
 *
 *   - `neotoma auth keygen` to generate the keypair.
 *   - `neotoma auth sign-example` to print a debugging curl.
 *   - `createApiClient` in `src/shared/api_client.ts` when a keypair is
 *     configured, so outbound CLI requests carry an AAuth signature and
 *     land as `hardware` / `software` tier instead of `anonymous`.
 *   - `neotoma mcp proxy --aauth` and the signed MCP dev shim, which read
 *     the same directory so Cursor (stdio MCP) and the CLI share one agent
 *     identity unless overridden with env vars.
 *
 * The private JWK never leaves the user's machine. Public-key discovery
 * happens out-of-band: the server verifies signatures against the
 * `jkt` thumbprint baked into the `aa-agent+jwt` agent token, so there
 * is no JWKS to publish for the CLI path.
 */
/** Default issuer written by `neotoma auth keygen` (shared CLI + MCP proxy). */
export declare const DEFAULT_AAUTH_ISSUER = "https://neotoma.cursor.local";
/** Default `sub` for software keys: Cursor-oriented, still valid for CLI HTTP. */
export declare function defaultAauthSoftwareSubject(): string;
export declare const AAUTH_CONFIG_DIR: string;
export declare const AAUTH_PRIVATE_JWK_PATH: string;
export declare const AAUTH_PUBLIC_JWK_PATH: string;
export declare const AAUTH_CONFIG_PATH: string;
export type SupportedAlg = "ES256" | "EdDSA";
export interface SignerFileConfig {
    /** AAuth subject — self-reported identity (e.g. `cursor-agent@myhost.local`). */
    sub: string;
    /** AAuth issuer — the authority that attests to this key. */
    iss: string;
    /** Optional `kid`; falls back to the one embedded in the JWK. */
    kid?: string;
    /** Agent-token JWT lifetime (default 300s). */
    token_ttl_sec?: number;
}
export interface LoadedSignerConfig {
    privateJwk: Record<string, unknown>;
    sub: string;
    iss: string;
    kid?: string;
    tokenTtlSec: number;
}
export declare class CliSignerConfigError extends Error {
    readonly code: "cli_signer_misconfigured";
}
/**
 * Generate a fresh AAuth keypair and persist it under {@link AAUTH_CONFIG_DIR}.
 * Refuses to overwrite an existing keypair unless `force` is set so an
 * accidental `neotoma auth keygen` does not silently invalidate an
 * already-trusted public key.
 */
export declare function generateAndStoreKeypair(options?: {
    alg?: SupportedAlg;
    sub?: string;
    iss?: string;
    force?: boolean;
}): Promise<{
    alg: SupportedAlg;
    publicJwk: Record<string, unknown>;
    thumbprint: string;
    privateJwkPath: string;
    publicJwkPath: string;
    configPath: string;
    config: SignerFileConfig;
}>;
/**
 * Load the CLI signer configuration from disk. Returns `null` when no
 * keypair is configured — callers should treat a null return as
 * "signing disabled" and fall back to unsigned requests. Throws
 * {@link CliSignerConfigError} when a keypair is present but the
 * configuration is corrupt (e.g. malformed JSON).
 */
export declare function loadCliSignerConfig(): Promise<LoadedSignerConfig | null>;
/** Shape of a single entry in the `https://neotoma.io/external_actors` JWT claim. */
export interface ExternalActorClaim {
    provider: "github";
    id: number;
    login: string;
    linked_at: string;
}
/** Build and sign an `aa-agent+jwt` agent token with the configured key. */
export declare function mintCliAgentTokenJwt(config: LoadedSignerConfig, options?: {
    /** When provided, embedded as `https://neotoma.io/external_actors` custom claim. */
    externalActors?: ExternalActorClaim[];
}): Promise<string>;
export interface CliSignedFetchOptions {
    method: string;
    headers?: Record<string, string>;
    body?: string;
    signal?: AbortSignal;
    configOverride?: LoadedSignerConfig;
}
/**
 * Signed fetch for CLI -> Neotoma API calls. Mirrors the agent-site
 * signed fetch but with CLI-sourced configuration. Returns an unsigned
 * `fetch` response when no keypair is configured so callers can use this
 * unconditionally (see `createApiClient`).
 */
export declare function cliSignedFetch(url: string, options: CliSignedFetchOptions): Promise<Response>;
/**
 * Build a debugging curl that replays a signed POST against the given
 * URL. Does not execute the request — just prints the command.
 */
export declare function buildSignedCurlExample(url: string, bodyJson: string): Promise<{
    curl: string;
    headers: Record<string, string>;
}>;
/**
 * Summarise the currently configured signer for `neotoma auth session`
 * output. Returns `null` when no keypair is configured.
 */
export declare function describeConfiguredSigner(): Promise<{
    configured: true;
    alg: SupportedAlg;
    sub: string;
    iss: string;
    thumbprint: string;
    private_jwk_path: string;
    public_jwk_path: string;
} | {
    configured: false;
    reason: string;
}>;
//# sourceMappingURL=aauth_signer.d.ts.map