/**
 * Ruflo helper-signing PUBLIC key (safe to commit). The matching private key is
 * held out-of-repo and provided to scripts/sign-helpers.mjs at publish time via
 * $RUFLO_HELPERS_SIGNING_KEY. Rotating the key = replace this constant + re-sign.
 *
 * ROTATED 2026-07-14 (v3.29.0): the previous key was accidentally exposed in a
 * Claude Code session transcript. Old GCP secret version 1 was destroyed (not
 * disabled) so it cannot be re-enabled; new v2 generated here. Users on old
 * ruflo versions keep the old pubkey and verify old manifests successfully;
 * upgrading to v3.29.0+ atomically picks up this new pubkey along with the
 * new-key-signed manifest.
 */
export declare const RUFLO_HELPERS_PUBKEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAyLl9cG+V/C+ffKWaSwvOsHdXSWmB5e3x1z9NUNvq6Ys=\n-----END PUBLIC KEY-----";
export declare const HELPERS_MANIFEST_FILE = "helpers.manifest.json";
export interface HelpersManifest {
    version: string;
    files: Record<string, string>;
}
export interface SignedHelpersManifest {
    manifest: HelpersManifest;
    signature: string;
    algorithm: 'ed25519';
}
export declare function sha256Hex(content: string | Buffer): string;
/**
 * Deterministic canonical bytes of a manifest — file keys sorted so the signer
 * and verifier agree byte-for-byte regardless of object insertion order.
 */
export declare function canonicalManifestBytes(m: HelpersManifest): Buffer;
/**
 * Verify a signed helpers manifest against ruflo's public key. Returns the
 * trusted file->sha256 manifest, or null on ANY failure (bad signature,
 * malformed JSON, wrong algorithm). Fail-closed — the caller MUST refuse to
 * install unverified helpers.
 */
export declare function verifyHelpersManifest(signedJson: string, pubkeyPem?: string): HelpersManifest | null;
//# sourceMappingURL=helper-signing.d.ts.map