/**
 * Ed25519 verification for remote machine actions pulled from the control
 * plane (GET /api/cli/bundle -> machineAction).
 *
 * The daemon must not execute an action just because the backend returned it:
 * a compromised backend/Firestore or stolen admin session could queue actions
 * for the whole fleet. Every action is signed server-side with a private key
 * held in GCP Secret Manager; this module re-builds the canonical payload and
 * verifies the signature against the public key pinned below.
 *
 * Enforcement: when a pinned/override public key is available, actions with a
 * missing or invalid signature are REJECTED. `FCD_MACHINE_ACTION_UNSIGNED_OK=1`
 * is an explicit, loudly-logged local escape hatch for rollout emergencies.
 *
 * Keep the canonical payload construction in sync with
 * backend/src/modules/discovery/machine-action-signing.ts.
 */
export declare const MACHINE_ACTION_SIGNATURE_VERSION = "fcd-machine-action-v1";
export interface VerifiableMachineAction {
    id: string;
    type: string;
    reason: string;
    createdAt: string;
    expiresAt: string;
    organizationId?: string;
    machineId?: string;
    signature?: {
        signature: string;
        keyId: string;
        alg: string;
        version: string;
    };
}
export interface MachineActionVerdict {
    ok: boolean;
    reason?: string;
}
export interface MachineActionVerifyContext {
    /**
     * The local machine's computed identity. When provided, a signed action bound
     * to a DIFFERENT machineId is rejected — a valid control-plane signature for
     * machine A must never execute on machine B (misrouted bundle, replay, or a
     * compromised delivery path). Actions without a machineId binding (legacy)
     * are unaffected.
     */
    localMachineId?: string;
}
/**
 * Verify a machine action before execution. Rejects when:
 *  - the signature is missing (unless the local escape hatch is set),
 *  - the signature's keyId is unknown,
 *  - the Ed25519 verification fails (any signed field was tampered with),
 *  - the action is already expired,
 *  - the action is bound to a different machineId than this machine
 *    (when `context.localMachineId` is provided; escape hatch:
 *    FCD_MACHINE_ACTION_ANY_MACHINE_OK=1 for legacy-fingerprint fleets).
 */
export declare function verifyMachineAction(action: VerifiableMachineAction, context?: MachineActionVerifyContext): MachineActionVerdict;