import type { SignedProvenConfig } from './proven-config.js';
/** The single RVFA section id that carries the signed manifest JSON. */
export declare const PROVEN_CONFIG_SECTION = "proven-config";
/** Header capability marker so a reader can tell this appliance apart. */
export declare const PROVEN_CONFIG_CAPABILITY = "proven-config";
/**
 * Pack a signed proven-config manifest into an RVFA appliance binary.
 *
 * The whole SignedProvenConfig (manifest + signature + algorithm) becomes the
 * payload, so the config-root signature travels inside the envelope. The RVFA
 * layer contributes integrity (footer + section hash), not authenticity.
 */
export declare function packProvenConfigRvfa(signed: SignedProvenConfig): Buffer;
/** True if `buf` looks like an RVFA container (starts with the RVFA magic). */
export declare function isProvenConfigRvfa(buf: Buffer): boolean;
/**
 * Unpack + integrity-check an RVFA-packed champion. Returns the inner
 * SignedProvenConfig, or null on ANY failure (bad magic, corrupt footer,
 * missing section, malformed JSON). Fail-closed — does NOT verify the Ed25519
 * signature; that stays with adoptSignedConfig (single config trust root).
 */
export declare function unpackProvenConfigRvfa(buf: Buffer): SignedProvenConfig | null;
//# sourceMappingURL=proven-config-rvfa.d.ts.map