/**
 * Reads the root trust private key PEM from an explicit file path.
 * Throws clearly if the file does not exist — never auto-generates keys.
 *
 * @param keyPath - Absolute or CWD-relative path to the private key PEM file.
 */
declare function loadPrivateKey(keyPath: string): string;
/**
 * Reads the root trust public key PEM from an explicit file path.
 * Throws clearly if the file does not exist — never auto-generates keys.
 *
 * @param keyPath - Absolute or CWD-relative path to the public key PEM file.
 */
declare function loadPublicKey(keyPath: string): string;

/**
 * Writes a base64 signature string to `<directory>/bundle.sig`.
 * Overwrites any existing file at that path.
 */
declare function writeSignature(signature: string, directory: string): void;
/** Reads and returns the raw base64 signature from `<directory>/bundle.sig`. */
declare function readSignature(directory: string): string;

/**
 * Reads the manifest JSON at `manifestPath`, canonicalizes it, and returns a
 * base64-encoded Ed25519 signature produced with the private key at `privateKeyPath`.
 *
 * @param manifestPath   - Absolute or CWD-relative path to a `bundle.manifest.json` file.
 * @param privateKeyPath - Explicit path to the PEM-encoded Ed25519 private key.
 * @returns Base64-encoded Ed25519 signature over the canonical manifest bytes.
 */
declare function signManifest(manifestPath: string, privateKeyPath: string): string;

declare function verifySignature(payload: string, signature: string | Buffer, publicKeyPem: string): boolean;

/**
 * Verifies `signature` (base64 Ed25519) over the already-serialized canonical
 * `manifest` string against the public key at `publicKeyPath`.
 *
 * Unlike `verifySignature`, this function accepts the manifest bytes directly
 * rather than reading them from disk — suited for in-memory verification flows.
 *
 * @param manifest      - Canonical manifest bytes (UTF-8 string).
 * @param signature     - Base64-encoded Ed25519 signature.
 * @param publicKeyPath - Explicit path to the PEM-encoded Ed25519 public key.
 */
declare function verifyManifestSignature(manifest: string, signature: string, publicKeyPath: string): boolean;

type SignBundleOptions = {
    bundlePath: string;
    signer: {
        sign(payload: string): Promise<string>;
    };
};
declare function signBundle(options: SignBundleOptions): Promise<void>;

export { loadPrivateKey, loadPublicKey, readSignature, signBundle, signManifest, verifyManifestSignature, verifySignature, writeSignature };