/**
 * Client-side registry signature verification (WS-B1, cross-cutting ⑤).
 *
 * `canonicalSigningPayload` MUST be byte-identical to the Hub's
 * `core/registry/registry-signing.ts` — a hand-written fixed field order joined by
 * newlines, never JSON. The shared golden vector in both repos' tests pins this so
 * the two implementations can never silently diverge (a drift would make every
 * signature fail to verify). Verification is a second anchor beside the sha256
 * checksum in the download path; the trusted public key is built into the client.
 */
export interface SignablePackage {
    id: string;
    version: string;
    checksum: string;
    sizeBytes: number;
}
/** Byte-exact canonical payload — keep identical to the Hub. Fixed order; never reorder. */
export declare function canonicalSigningPayload(p: SignablePackage): string;
/**
 * Normalize a PEM that may arrive with escaped newlines. The trusted public key is
 * sourced from env (QLOGIC_REGISTRY_SIGNING_PUBLIC_KEY_PEM); env_file / single-line
 * secret stores deliver `\n` as literal backslash-n, which createPublicKey rejects.
 * No-op when the PEM already has real newlines, so it never affects valid keys.
 */
export declare function normalizePem(pem: string): string;
/** Verify an Ed25519 signature (base64) over the canonical payload. False on any error. */
export declare function verifyPackageSignature(p: SignablePackage, signatureBase64: string, publicKeyPem: string): boolean;
/**
 * Signature gate mode (WS-B1 gradual rollout): "warn" logs but installs; "strict"
 * refuses an install whose signature is missing or invalid. Sourced from
 * QLOGIC_REGISTRY_SIGNATURE_MODE; defaults to "warn" so backfill can precede strict.
 */
export type SignatureMode = "warn" | "strict";
export declare function resolveSignatureMode(value: string | undefined): SignatureMode;
export interface SignedResolution extends SignablePackage {
    signature?: string | null;
    signingKeyId?: string | null;
}
/**
 * Dual-anchor signature gate (WS-B1) applied beside the sha256 check on install.
 * strict: throw on a missing or invalid signature. warn (default): never throw —
 * return the outcome so the caller can log it. A missing trusted public key (key
 * ceremony not yet done) behaves like "unsigned" so warn-mode installs proceed.
 */
export declare function checkResolutionSignature(resolution: SignedResolution, mode: SignatureMode, trustedPublicKeyPem: string | undefined): {
    verified: boolean;
    reason?: "unsigned" | "no-trusted-key" | "invalid-signature";
};
