/**
 * Production Ed25519 public key used to verify the update manifest.
 *
 * The signing key lives offline with the release operator; only the public
 * half ever ships in the binary. The release operator generates the keypair
 * and embeds the public half with `scripts/release-keygen.mjs --write-source`;
 * see the "Release signing & key management" runbook in `docs/cadre-host.md`.
 * For dev/CI/staging overrides see `CADRE_HOST_UPDATE_DEV_KEY`.
 */
import type { KeyObject } from 'node:crypto';
/**
 * Public key (32 raw bytes, base64) — env override beats the embedded one.
 * Used by both production and CI smoke tests.
 */
export declare function getReleasePublicKeyBase64(env?: NodeJS.ProcessEnv): string;
/** Lazily build the KeyObject used by `crypto.verify`. */
export declare function getReleasePublicKey(env?: NodeJS.ProcessEnv): KeyObject;
/**
 * True when the *effective* release key (after the `CADRE_HOST_UPDATE_DEV_KEY`
 * override) decodes to 32 zero bytes — i.e. the all-zeros placeholder that
 * ships in source until the release operator embeds a real public key.
 *
 * Consumers:
 *  - the publish guard (`scripts/publish-package.mjs`) refuses to ship a build
 *    whose embedded key is still the placeholder, so a real release can never
 *    silently ship the dead key;
 *  - `UpdateService.check()` logs a diagnostic breadcrumb so a misbuilt binary
 *    is recognizable from logs rather than only as opaque `signature_invalid`.
 */
export declare function isPlaceholderReleaseKey(env?: NodeJS.ProcessEnv): boolean;
/**
 * Build an Ed25519 KeyObject from a raw 32-byte base64 public key by wrapping
 * it in the SubjectPublicKeyInfo DER prefix Node expects.
 */
export declare function ed25519FromRaw(base64Raw: string): KeyObject;