export declare const EVO_PACK_REGISTRY_FORMAT = 1;
export declare const EVO_PACK_REGISTRY_MAX_ENTRIES = 10000;
export interface EvoHttpsRawFileSource {
    kind: "https";
    rawUrl: string;
}
export interface EvoGitRawFileSource {
    kind: "git";
    repository: string;
    revision: string;
    path: string;
    rawUrl: string;
}
export interface EvoGistRawFileSource {
    kind: "gist";
    gistId: string;
    revision: string;
    file: string;
    rawUrl: string;
}
/**
 * A raw-file locator records both the retrieval URL and immutable provenance
 * when the file comes from git or a gist. Direct HTTPS locations rely on the
 * signed pack integrity for content identity.
 */
export type EvoRawFileSource = EvoHttpsRawFileSource | EvoGitRawFileSource | EvoGistRawFileSource;
export interface EvoPackRegistrySignature {
    algorithm: "ed25519";
    signer: string;
    value: string;
}
export type EvoPackRegistrySignatureIdentity = Pick<EvoPackRegistrySignature, "algorithm" | "signer">;
export interface EvoPackRegistryEntry {
    name: string;
    version: string;
    integrity: string;
    author?: string;
    description?: string;
    source: EvoRawFileSource;
    signature?: EvoPackRegistrySignature;
}
export interface EvoPackRegistryIndex {
    registryFormat: 1;
    entries: EvoPackRegistryEntry[];
}
export interface EvoTrustedRegistrySigner {
    id: string;
    publicKeyPem: string;
}
export type EvoPackRegistryEntryTrust = {
    status: "trusted";
    trusted: true;
    signer: string;
} | {
    status: "unsigned";
    trusted: false;
} | {
    status: "untrusted-signer";
    trusted: false;
    signer: string;
};
/** Parse a registry or pack raw-file locator without performing I/O. */
export declare function parseEvoRawFileSource(value: unknown): EvoRawFileSource;
/** Parse one exact, signed-or-unsigned pack registry entry. */
export declare function parseEvoPackRegistryEntry(value: unknown, label?: string): EvoPackRegistryEntry;
/** Parse a fail-closed v1 registry index and reject ambiguous identities. */
export declare function parseEvoPackRegistryIndex(value: unknown): EvoPackRegistryIndex;
/** Canonical, domain-separated bytes that bind one entry and its signer provenance. */
export declare function canonicalEvoPackRegistryEntryMetadata(value: unknown, signatureIdentity?: EvoPackRegistrySignatureIdentity): string;
export declare function validateTrustedEvoRegistrySigners(signers: readonly EvoTrustedRegistrySigner[]): void;
/** Select a trusted key by exact signer ID; keys are never guessed or tried in sequence. */
export declare function selectTrustedEvoRegistrySigner(signers: readonly EvoTrustedRegistrySigner[], signerId: string): EvoTrustedRegistrySigner | undefined;
/**
 * Evaluate one entry against the caller's trust roots. Unsigned and unknown-key
 * entries remain discoverable but explicitly untrusted. A bad signature from a
 * selected trusted signer rejects the entry.
 */
export declare function verifyEvoPackRegistryEntryTrust(value: unknown, trustedSigners: readonly EvoTrustedRegistrySigner[]): EvoPackRegistryEntryTrust;
//# sourceMappingURL=registry.d.ts.map