/**
 * PolicyPack signing — deterministic sha256 manifests with optional cosign
 * signature verification. Manifest format mirrors `sha256sum`:
 *
 *   <64-char-hex>  <filename>
 *
 * filenames are plain (no leading `./`), sorted case-sensitively, separated by
 * two spaces. One entry per line. Line endings are LF.
 *
 * When a user passes `--policies-require-signed`, every file in the directory
 * must appear in the manifest, and every entry in the manifest must hash-
 * match. Optional cosign verification (`--cosign-pubkey`) runs the `cosign`
 * binary as a subprocess on `<manifest>.sig` — we never bundle cosign.
 */
import type { PolicyPackFileSource } from './policy-pack.js';
/** Canonical filenames that `archrad policies-sha256` writes. */
export declare const POLICY_PACK_MANIFEST_NAME = "archrad-policy-pack.sha256";
export declare const POLICY_PACK_SIGNATURE_NAME = "archrad-policy-pack.sha256.sig";
/** One `<hex>  <filename>` entry parsed from a manifest. */
export type PolicyPackManifestEntry = {
    sha256: string;
    filename: string;
};
export type PolicyPackManifestVerification = {
    ok: true;
    /** Files that were hash-verified. Same order as the manifest. */
    verified: string[];
} | {
    ok: false;
    errors: string[];
};
export type CosignVerificationResult = {
    ok: true;
    stdout: string;
} | {
    ok: false;
    error: string;
};
/** Compute the sha256 of a buffer or string as lowercase hex. */
export declare function sha256Hex(content: string | Uint8Array): string;
/**
 * Build the manifest text for a set of in-memory policy sources.
 * Filenames are sorted case-sensitively for determinism.
 */
export declare function buildPolicyPackManifest(sources: ReadonlyArray<PolicyPackFileSource>): string;
/**
 * Parse a sha256sum-style manifest. Blank lines and lines starting with `#`
 * are ignored so users can annotate manifests.
 */
export declare function parsePolicyPackManifest(text: string): PolicyPackManifestEntry[];
/**
 * Verify in-memory policy sources against a manifest. Strict: every entry in
 * the manifest must exist and hash-match, and every source file must be
 * listed in the manifest. Duplicate manifest entries are rejected.
 */
export declare function verifyPolicyPackManifest(sources: ReadonlyArray<PolicyPackFileSource>, manifestText: string): PolicyPackManifestVerification;
export type CosignVerifyOptions = {
    /** Absolute path to the manifest file being verified. */
    manifestPath: string;
    /** Absolute path to the `<manifest>.sig` signature file. */
    signaturePath: string;
    /** Absolute path to the cosign public key (PEM / `cosign.pub`). */
    publicKeyPath: string;
    /**
     * Override the `cosign` binary (default: `cosign` on PATH). Injected by
     * tests; in production the flag / env drive behaviour.
     */
    cosignBinary?: string;
};
/**
 * Verify a detached cosign signature over a blob. Uses `cosign verify-blob`
 * as a subprocess. Returns `ok: false` with a user-facing error message if
 * cosign is missing from PATH, if the signature is invalid, or if the public
 * key rejects it.
 *
 * We intentionally shell out rather than pulling the cosign library in: the
 * OSS CLI stays dependency-light, and operators almost always already have
 * cosign available in CI.
 */
export declare function verifyCosignSignature(opts: CosignVerifyOptions): CosignVerificationResult;
/**
 * Convenience reader used by the CLI: returns manifest + signature metadata
 * present alongside a policies directory, or `null` for any file that is
 * absent. Caller decides how to handle "manifest missing" based on
 * require-signed mode.
 */
export declare function discoverPolicyPackManifest(dir: string): Promise<{
    manifestPath: string;
    manifestText: string | null;
    signaturePath: string;
    signatureExists: boolean;
}>;
//# sourceMappingURL=policy-pack-sign.d.ts.map