export declare const SIGNATURE_RELATIVE = ".claude-plugin/signature.json";
export interface PluginFileEntry {
    path: string;
    sha256: string;
}
export interface PluginManifest {
    plugin: string;
    version: string;
    files: PluginFileEntry[];
}
export interface SignedPluginManifest {
    manifest: PluginManifest;
    signature: string;
    algorithm: 'ed25519';
}
export type VerifyResult = 'verified' | 'modified' | 'unsigned' | 'bad-signature';
export interface PluginVerification {
    plugin: string;
    dir: string;
    result: VerifyResult;
    /** Files whose digest differs from the signed one. */
    changed: string[];
    /** Signed files that are gone. */
    missing: string[];
    /** Files present on disk that the signature does not list. */
    extra: string[];
    version?: string;
}
/** Canonical bytes: fixed key order, files sorted by path. MUST match scripts/sign-plugins.mjs. */
export declare function canonicalPluginManifestBytes(m: PluginManifest): Buffer;
/**
 * Every file under a plugin root, as posix paths, excluding the signature
 * itself. A symlink is an entry of its own (digest of `link:<target>`), never
 * followed: following it would let a link swap in content the digest never saw.
 */
export declare function digestPluginDir(root: string): PluginFileEntry[];
/** Signature check only: true when `signed.signature` verifies over its manifest. */
export declare function signatureValid(signed: SignedPluginManifest, pubkeyPem?: string): boolean;
/**
 * Check a plugin directory against its signature.json. `expectName` (the
 * marketplace name) must match the signed plugin name: a valid signature
 * copied from another plugin is a bad signature here, not a pass.
 */
export declare function verifyPluginDir(dir: string, expectName: string, pubkeyPem?: string): PluginVerification;
export interface MarketplacePlugin {
    name: string;
    dir: string;
}
/** The plugins a marketplace clone lists, each with its directory (its `source`, else plugins/<name>). */
export declare function listMarketplacePlugins(clone: string): MarketplacePlugin[];
/** One line per verification, with the differing files named (capped). */
export declare function describeVerification(v: PluginVerification, cap?: number): string;
//# sourceMappingURL=signature.d.ts.map