import type { HostSettings } from "../host/host.js";
import type { Checkpoint, CheckpointJSON } from "./state/checkpointStore.js";
/** Both shapes a checkpoint travels as: the live class instance, and the
 *  plain parsed JSON the external resume path carries. */
export type SignableCheckpoint = Checkpoint | CheckpointJSON;
/** Thrown only when a key is PRESENT but shorter than 32 bytes. An unset key
 *  is not an error — it means signing is off. */
export declare class CheckpointKeyTooShortError extends Error {
    constructor(bytes: number);
}
/** Whether two strings are equal, taking the same time for every pair of
 *  the same length, so the time taken says nothing about where the first
 *  difference is. The lengths are compared first; a signature is always
 *  64 hex characters, so a length mismatch gives nothing away. */
export declare function constantTimeEqual(a: string, b: string): boolean;
/** Embed a checksum in `cp.signature` when `settings`, the settings of the
 *  run's host, hold a key; no-op otherwise. The caller passes the host's
 *  settings because signing happens after awaits, where the current run
 *  cannot be read. */
export declare function signCheckpoint(cp: SignableCheckpoint, settings: HostSettings): void;
/** True iff `cp` carries a signature valid under the configured key or one of
 *  the retired keys in AGENCY_CHECKPOINT_KEY_OLD, compared in constant time.
 *  False if the signature is absent, matches no key, or no key is configured —
 *  a stripped signature therefore reads as NOT verified (downgrade guard).
 *  The keys come from `settings`: the run's host inside the runtime, and the
 *  platform's default host (the environment, on Node) for a host that
 *  verifies a checkpoint outside any run. */
export declare function verifyCheckpointChecksum(cp: SignableCheckpoint, settings?: HostSettings): boolean;