/**
 * Emits only the canonical public payload for an external Ed25519 signer.
 * No private key path, environment variable, or signing primitive is accepted.
 */
export declare function writePluginPackageSigningPayload(archivePath: string, metadataPath: string, outputPath: string): Promise<Readonly<{
    pluginId: string;
    version: string;
    packageDigest: `sha256:${string}`;
    archiveDigest: `sha256:${string}`;
    payloadPath: string;
    payloadBytes: number;
    payloadDigest: `sha256:${string}`;
    algorithm: "Ed25519";
    privateKeyUsed: false;
}>>;
export declare function verifyPluginPackageOffline(archivePath: string, metadataPath: string, trustStorePath: string): Promise<Readonly<{
    verified: true;
    publisherId: string;
    publisherName: string;
    keyId: string;
    pluginId: string;
    version: string;
    runtime: "native" | "sandboxed-page";
    packageDigest: `sha256:${string}`;
    archiveDigest: `sha256:${string}`;
    updatePolicy: import("./internal/plugin-signing.js").PluginPackageUpdatePolicy;
}>>;
