/**
 * AAuth client signer for outbound MCP proxy requests.
 *
 * Uses `@hellocoop/httpsig` (the same library Neotoma's CLI signer uses)
 * to produce RFC 9421 HTTP Message Signatures with an `aa-agent+jwt`
 * Signature-Key header that Neotoma's `aauthVerify` middleware expects.
 *
 * Wire format:
 *   Signature-Key:   aasig=jwt;jwt="<aa-agent+jwt>"
 *   Signature-Input: aasig=(...);created=<unix>;keyid="<jkt>";alg="ecdsa-p256-sha256"
 *   Signature:       aasig=:<base64>:
 *   Content-Digest:  sha-256=:<base64>:
 */
export declare class SignerConfigError extends Error {
    constructor(message: string);
}
export interface AAuthSignerConfig {
    privateJwk: Record<string, unknown>;
    sub: string;
    iss: string;
    kid: string;
    tokenTtlSec: number;
    authorityOverride?: string;
}
/**
 * Execute a signed fetch against the downstream URL using `@hellocoop/httpsig`.
 * Explicitly override the library defaults so request bodies include
 * `content-digest`, which Neotoma's strict AAuth verifier can validate.
 */
export declare function signedFetch(url: string, opts: {
    method: string;
    headers: Record<string, string>;
    body: string;
    config: AAuthSignerConfig;
}): Promise<Response>;
export declare function loadSignerConfigFromEnv(): AAuthSignerConfig;
//# sourceMappingURL=aauth_client_signer.d.ts.map