/** Ruflo config-signing PUBLIC key (safe to commit). Private half in GCP Secret Manager (ruflo-config-signing-key). */
export declare const RUFLO_CONFIG_PUBKEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA3zr3BLCFKyrjvjZg9BXxchXIuGYwYwq21FYCjTpQO6A=\n-----END PUBLIC KEY-----";
/** The receipt bundle (ADR-176) — reproducible proof-of-work summary. */
export interface ProvenConfigReceipt {
    heldOutDelta?: number;
    redblue?: 'PASS' | 'FAIL' | 'SKIPPED';
    drift?: number;
    canary?: {
        rollbackRate?: number;
        latencyP95?: number;
        costPerTask?: number;
    };
    receiptCoverage?: number;
}
/** The constraint contract (ADR-177 §signed != suitable) + policy reference + receipt. */
export interface ProvenConfigManifest {
    schema: string;
    policy: {
        ref: string;
        value?: Record<string, unknown>;
    };
    host?: Record<string, string>;
    platform?: string[];
    compatibility?: Record<string, string>;
    benchmark?: {
        corpus: string;
        corpusHash: string;
    };
    layer?: string;
    receipt?: ProvenConfigReceipt;
    rollback?: {
        previousManifest?: string;
    };
}
export interface SignedProvenConfig {
    manifest: ProvenConfigManifest;
    signature: string;
    algorithm: 'ed25519';
}
/** The local environment a manifest's constraints are checked against. */
export interface InstallEnv {
    platform: string;
    hosts?: Record<string, string>;
    versions?: Record<string, string>;
    layer?: string;
}
export declare function sha256Hex(content: string | Buffer): string;
/**
 * Deterministic canonical bytes — recursively sorted object keys so signer and
 * verifier agree byte-for-byte regardless of insertion order.
 */
export declare function canonicalManifestBytes(m: ProvenConfigManifest): Buffer;
/** Sign a manifest (publish-time; key from GCP via scripts). */
export declare function signProvenConfig(manifest: ProvenConfigManifest, privateKeyPem: string): SignedProvenConfig;
/**
 * Verify a signed manifest against ruflo's config public key. Returns the
 * manifest on success, or null on ANY failure (bad signature, malformed JSON,
 * wrong algorithm, missing fields). Fail-closed.
 */
export declare function verifyProvenConfig(signedJson: string | SignedProvenConfig, pubkeyPem?: string): ProvenConfigManifest | null;
/**
 * Minimal semver-range satisfier for the compat contract. Supports `>=X`, `>X`,
 * `<=X`, `<X`, `=X`, and a bare version `X` (treated as `>=X`). Deliberately
 * small — the manifest contract only uses min-version bounds.
 */
export declare function satisfiesRange(installed: string, range: string): boolean;
export interface SuitabilityResult {
    suitable: boolean;
    reason?: string;
}
/**
 * Check a manifest's constraint contract against the local environment.
 * Fail-closed: a missing/unsatisfiable constraint => not suitable (safe skip).
 * A constraint the manifest doesn't declare is not required.
 */
export declare function isSuitable(manifest: ProvenConfigManifest, env: InstallEnv): SuitabilityResult;
/**
 * The combined adoption decision (ADR-177): a manifest is adoptable iff it is
 * both authentic (signature verifies) AND suitable (constraints satisfied).
 */
export declare function evaluateForAdoption(signedJson: string | SignedProvenConfig, env: InstallEnv, pubkeyPem?: string): {
    adopt: boolean;
    manifest?: ProvenConfigManifest;
    reason: string;
};
//# sourceMappingURL=proven-config.d.ts.map