/**
 * Pure (no I/O, no network) download-integrity logic for the shared `gamedev-mcp-server` binary — the
 * port of the CLIs' `server-checksum` seam. {@link verifyZip} is the single fail-closed verdict the
 * downloader calls BETWEEN fetching the zip bytes and unzipping them, so a downloaded server zip is
 * NEVER extracted or executed unless its SHA256 matches the release's published `SHA256SUMS` manifest
 * (a compromised release asset or a trusted-CA MITM would otherwise yield arbitrary code execution).
 * Keeping this pure makes every decision unit-testable with no real download.
 */
/** GitHub repo the server binaries + the `SHA256SUMS` manifest are released from. */
export declare const SERVER_RELEASE_REPO = "IvanMurzak/GameDev-MCP-Server";
/** The integrity-manifest asset name attached to every release. */
export declare const SHA256SUMS_ASSET_NAME = "SHA256SUMS";
/** The per-RID server zip asset name, e.g. `gamedev-mcp-server-win-x64.zip`. */
export declare function serverZipAssetName(rid: string): string;
/** The release-asset download URL for a RID + version (tags are `v`-prefixed). */
export declare function serverDownloadUrl(rid: string, version: string): string;
/** The `SHA256SUMS` manifest URL — the sibling of the per-RID zip under the same `v<version>` tag. */
export declare function serverChecksumsUrl(version: string): string;
/**
 * Parse a coreutils `sha256sum` manifest into a `{ filename → lowercase-hex }` map. Tolerates CRLF/LF,
 * blank lines, a single-space or tab separator, and the binary-mode `*` marker. A line whose first
 * token is not 64-hex, or with no filename, is skipped (never produces a spurious entry). On a
 * duplicate filename the last entry wins. Never throws.
 */
export declare function parseSha256Sums(sha256SumsText: string | null | undefined): Map<string, string>;
/** Look up the expected digest for an EXACT asset name (`linux-x64` never matches `linux-arm64`). */
export declare function lookupDigest(parsed: Map<string, string>, assetZipName: string): string | null;
/** Case-insensitive hex-digest equality; an empty digest on either side is NEVER a match (fail-closed). */
export declare function verifyDigest(expected: string | null | undefined, actual: string | null | undefined): boolean;
/** The verdict of verifying a downloaded zip against a release `SHA256SUMS` manifest. */
export type ChecksumVerdict = "verified" | "manifest-unparsable" | "missing-entry" | "digest-mismatch";
/**
 * The single fail-closed integrity decision the downloader calls BEFORE unzipping: parse `SHA256SUMS`,
 * find the entry for `assetZipName`, compare (case-insensitive hex) to the downloaded zip's SHA256.
 * Returns `'verified'` ONLY when the manifest parsed, contained the asset, and the digest matched;
 * every other outcome is a distinct fail-closed verdict the caller MUST treat as "do NOT extract".
 */
export declare function verifyZip(sha256SumsText: string | null | undefined, assetZipName: string, actualZipHexDigest: string | null | undefined): ChecksumVerdict;
/** A short, actionable reason for a non-`verified` verdict. */
export declare function checksumFailureReason(verdict: ChecksumVerdict, assetZipName: string): string;
//# sourceMappingURL=server-checksum.d.ts.map