/**
 * Signatures on data-latest manifests.
 *
 * The publish job in .github/workflows/data.yml signs each manifest with an
 * ed25519 key held only in the data-publish environment, which only workflows
 * running on main can use. Servers accept a manifest only if a key listed here
 * verifies it. Replacing release assets by hand, or from a workflow on another
 * branch, therefore cannot put an index on users' machines: without the key it
 * cannot produce a manifest they accept, and the manifest carries the index's
 * size and SHA-256.
 *
 * To rotate: generate a new key pair, add its public key here, release, then
 * replace the DATA_SIGNING_KEY secret and DATA_SIGNING_PUBLIC_KEY in data.yml.
 * Remove the old key in a later release.
 */
export interface TrustedKey {
    /** First 16 hex characters of the SHA-256 of the raw public key. */
    id: string;
    /** The raw 32-byte ed25519 public key, base64. */
    publicKey: string;
}
export declare const TRUSTED_KEYS: readonly TrustedKey[];
export declare function keyIdFor(publicKey: string): string;
export declare class SignatureError extends Error {
}
/**
 * Check a signed manifest and return the manifest JSON it carries. The payload
 * is verified as the exact string that was signed, before anything parses it.
 */
export declare function verifySignedManifest(envelope: unknown, keys?: readonly TrustedKey[]): string;