/**
 * Pattern store security helpers (#4750).
 *
 * Small, dependency-light helpers shared by the download and discovery paths:
 * - strict name sanitizing so a registry entry cannot escape the cache dir,
 * - a path containment assertion used right before any write,
 * - one Ed25519 verification helper used for both patterns and registries.
 *
 * Ed25519 uses the same RFC 8032 strict mode (@noble/ed25519, zip215:false)
 * as transfer/ipfs/client.ts and the existing verifySignature().
 */
/**
 * Allowed shape for a pattern/registry name or version component.
 * Anything outside [A-Za-z0-9._-] is stripped.
 */
export declare function sanitizeName(raw: string): string;
/**
 * Assert that `target` resolves to a path inside `root`.
 * Throws when the resolved path escapes the root (e.g. via ../ or an absolute
 * segment). `root` and `target` are resolved before comparison.
 */
export declare function assertInside(root: string, target: string): string;
/**
 * Verify an `ed25519:<hex>` signature over `content` with an `ed25519:<hex>`
 * public key. Any malformed input or verification error is a failure (false).
 */
export declare function verifyEd25519(content: Buffer, signature: string, publicKey: string): Promise<boolean>;
//# sourceMappingURL=security.d.ts.map