import { type PluginVerification, type VerifyResult } from './signature.js';
export declare const VERIFY_STATUS_RELATIVE: string;
export interface VerifyStatusEntry {
    writtenAt: string;
    clone: string;
    /**
     * Plugin name → the WORST result across its clone copy and every install-cache
     * copy: Claude Code loads an installed plugin from the cache, so a clean clone
     * next to a tampered cache must not read as verified.
     */
    plugins: Record<string, VerifyResult>;
    /** Plugin directory (normalized, see normalizeTrustPath) → that copy's own result: the mod looks up the dir it is loading. */
    paths?: Record<string, VerifyResult>;
}
export interface VerifyStatusFile {
    version: 1;
    byConfigDir: Record<string, VerifyStatusEntry>;
}
/**
 * The one spelling of a path both sides key on (the CLI writing, the mod
 * reading): forward slashes, no repeated or trailing slash, and a Windows
 * drive path lower-cased (Windows paths are case-insensitive, and HOME /
 * USERPROFILE / os.homedir() disagree on separators). Kept byte-identical to
 * plugins/ruflo-mods/hooks/trust.ts normalizeTrustPath.
 */
export declare function normalizeTrustPath(p: string): string;
/** The worse of two results (bad-signature > modified > unsigned > verified). */
export declare const worseResult: (a: VerifyResult | undefined, b: VerifyResult) => VerifyResult;
export declare const verifyStatusPath: (home?: string) => string;
export declare function readVerifyStatus(home?: string): VerifyStatusFile;
/**
 * Record the clone's results and the install-cache copies' (`cache`): per plugin
 * the worst of all its copies, and per copy its own result keyed by directory.
 */
export declare function writeVerifyStatus(configDir: string, clone: string, results: readonly PluginVerification[], home?: string, cache?: readonly PluginVerification[]): string;
/** Verify every plugin a clone lists (or only `names`). A plugin not in the clone is skipped. */
export declare function verifyClone(clone: string, names?: readonly string[]): PluginVerification[];
/** Install-cache copies of ruflo plugins (installed_plugins.json), each verified as its own row. */
export declare function verifyInstallCache(configDir: string, marketplace: string, names?: readonly string[]): PluginVerification[];
/** The results that §2.1 makes enforceable under refuse-risky. */
export declare const isUntrusted: (r: VerifyResult) => r is "modified" | "bad-signature";
//# sourceMappingURL=verify-status.d.ts.map