/**
 * Public key registry for authentication
 * Maps bearer tokens (base64url-encoded public keys) to user identities
 */
/**
 * Register a public key (derived from bearer token).
 * Only accepts tokens that decode to exactly 32 bytes (Ed25519 public key);
 * rejects JWTs and other non-key tokens so they are validated as session tokens.
 */
export declare function registerPublicKey(bearerToken: string, userId?: string): void;
/**
 * Get public key from bearer token
 */
export declare function getPublicKey(bearerToken: string): Uint8Array | null;
/**
 * Verify bearer token is registered
 */
export declare function isBearerTokenValid(bearerToken: string): boolean;
/**
 * Get userId for a registered bearer token (if it was registered with userId)
 */
export declare function getUserIdFromBearerToken(bearerToken: string): string | undefined;
/**
 * Auto-register public key if not exists (for first-time users)
 * Returns true if registration succeeded, false if token format is invalid
 */
export declare function ensurePublicKeyRegistered(bearerToken: string): boolean;
/**
 * Get all registered public keys (for admin/debugging)
 */
export declare function getAllPublicKeys(): Array<{
    bearerToken: string;
    userId?: string;
    createdAt: Date;
}>;
//# sourceMappingURL=public_key_registry.d.ts.map