/**
 * meta-proxy release verification (ADR-307) — mirrors src/init/helper-signing.ts's
 * raw-EdDSA `crypto.verify(null, ...)` pattern almost exactly, and matches the
 * exact scheme confirmed live 2026-07-16 against a real v0.1.0 release: ONE
 * combined `SHA256SUMS.sig` (raw Ed25519 over the `SHA256SUMS` file's bytes,
 * base64-encoded — not a per-binary signature), then a per-asset SHA-256
 * check against the matching `SHA256SUMS` line. Refuse-all-or-nothing on any
 * mismatch, same discipline as `writeCriticalHelpers()`.
 *
 * @module proxy/verify
 */
/**
 * meta-proxy's committed release-signing public key (SPKI PEM), confirmed
 * live 2026-07-16 by verifying a real `SHA256SUMS.sig` from the v0.1.0
 * release against it (crypto.verify -> true).
 */
export declare const PROXY_RELEASE_PUBKEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=\n-----END PUBLIC KEY-----";
export declare class ReleaseVerificationError extends Error {
    constructor(message: string);
}
/** Raw EdDSA verify of `SHA256SUMS.sig` (base64) over `SHA256SUMS`'s exact bytes. */
export declare function verifySha256SumsSignature(sumsBytes: Buffer, sigBase64: string, pubkeyPem?: string): boolean;
export type ParsedChecksums = Record<string, string>;
/** Parses `<sha256>  <filename>` lines (sha256sum's own output format). */
export declare function parseSha256Sums(sumsText: string): ParsedChecksums;
export declare function sha256Hex(bytes: Buffer): string;
export interface VerifyReleaseInput {
    sumsBytes: Buffer;
    sigBase64: string;
    assetBytes: Buffer;
    assetFilename: string;
    pubkeyPem?: string;
}
export interface VerifyReleaseResult {
    sha256: string;
}
/**
 * Full verification: signature over SHA256SUMS, then the asset's own hash
 * against the matching line. Throws `ReleaseVerificationError` on ANY
 * failure — there is no partial-trust outcome, matching ADR-307's "refuses
 * on any mismatch" requirement.
 */
export declare function verifyRelease(input: VerifyReleaseInput): VerifyReleaseResult;
//# sourceMappingURL=verify.d.ts.map