import { type Action, type CommandSpec, type ExecAction } from "../internals/plan.js";
import type { Runner } from "../internals/proc.js";
import type { Check } from "../internals/verify.js";
export declare function sha256Hex(input: string): string;
export declare function signatureFailureCheck(what: string, tool: string): NonNullable<ExecAction["failureCheck"]>;
/**
 * SHA256SUMS signing. Best-effort by default (`allowFailure: true` — the
 * fleet-bundle idiom), with a strict mode for enterprise evidence gates. Shared
 * with `aih evidence build`, which emits the same bundle-standard layout.
 */
export declare function signAction(out: string, signer: unknown, what?: string, opts?: {
    allowFailure?: boolean;
    sumsSha256?: string;
}): Action | undefined;
export declare function verifyBundleChecksums(bundleRoot: string): Check;
export declare function verifyGithubBundleAttestation(bundleRoot: string, repo: string, run: Runner): Promise<Check>;
export declare const command: CommandSpec;
export declare const verifyCommand: CommandSpec;