/**
 * A wallet whose key lives in AWS KMS (spec `wallet-signers`). The key never
 * leaves KMS: the client hashes locally, KMS signs the 32-byte digest, and the
 * DER signature becomes an Ethereum signature with a low-s value (EIP-2) and
 * the recovery id under which it recovers to the wallet's address. A signature
 * that recovers to no address of this wallet is refused before anything
 * carrying it is sent.
 *
 * The algorithm mirrors the gateway's `services/kms-signer.ts`; both keep the
 * same vectors in their tests.
 */
import type { Hex, LocalAccount } from "viem";
import type { WalletSigner } from "../../../core-dist/wallet.js";
import { LocalError } from "../../errors.js";
import { type KmsStack } from "../_paid-stack.js";
/** The part of a KMS client the signer uses; tests pass a fake. */
export interface KmsClientLike {
    send(command: unknown): Promise<unknown>;
}
/** Parse an ECDSA DER signature (SEQUENCE { INTEGER r, INTEGER s }). */
export declare function parseDerSignature(der: Uint8Array): {
    r: bigint;
    s: bigint;
};
/**
 * KMS's DER signature over `hash` → a 65-byte Ethereum signature that recovers
 * to `address`, or `SIGNER_ADDRESS_MISMATCH`.
 */
export declare function derToEthereumSignature(viem: Pick<KmsStack["viem"], "recoverAddress" | "serializeSignature" | "numberToHex">, der: Uint8Array, hash: Hex, address: string): Promise<Hex>;
/** A KMS/AWS failure as a named local error with its remedy; never renders a credential. */
export declare function kmsError(err: unknown, signer: WalletSigner, context: string): LocalError;
export interface KmsAccountOptions {
    /** Test seam: a stack (or part of one) in place of the lazily loaded peers. */
    stack?: KmsStack;
    client?: KmsClientLike;
}
/** A viem account that signs through `signer` as `address`. */
export declare function kmsAccount(signer: WalletSigner, address: string, opts?: KmsAccountOptions): Promise<LocalAccount>;
export interface AdoptedKmsKey {
    address: string;
    key_spec: string;
    key_usage: string;
}
/**
 * Read a KMS key's public key and metadata (read-only: `GetPublicKey` only)
 * and derive its address; `KMS_KEY_UNSUITABLE` unless it is a secp256k1
 * signing key.
 */
export declare function adoptKmsKey(signer: WalletSigner, opts?: KmsAccountOptions): Promise<AdoptedKmsKey>;
/** The EVM address of a secp256k1 SubjectPublicKeyInfo (what KMS GetPublicKey returns). */
export declare function addressFromSpki(viem: Pick<KmsStack["viem"], "keccak256" | "getAddress">, der: Uint8Array): string;
/** Test seam: forget cached clients. */
export declare function resetKmsClientsForTests(): void;
//# sourceMappingURL=kms.d.ts.map