/**
 * Auto-download and manage ONNX Runtime shared library for semantic search.
 *
 * Downloads the CPU-only ONNX Runtime from Microsoft's GitHub releases.
 * The library is cached in the storage directory alongside semantic index data.
 *
 * Security hardening: an earlier implementation used `curl` with no size cap,
 * no archive containment validation, no install lock, and no integrity
 * verification — an install path that bypassed every defense the LSP GitHub
 * installer already had. This brings ONNX onto the same security floor:
 *
 *   - Streaming size cap via fetch + ReadableStream transformer (`MAX_DOWNLOAD_BYTES`).
 *   - Streaming SHA-256 of the downloaded archive, persisted in `.aft-onnx-installed`.
 *   - Atomic O_EXCL install lock with PID-aware stale-lock recovery.
 *   - Containment-checked extraction: every file under the staging dir
 *     must be inside the staging root, no symlinks allowed before move.
 *   - Total extracted size cap (`MAX_EXTRACT_BYTES`) to defeat decompression
 *     bombs.
 *   - TOFU verification: if `.aft-onnx-installed` already records a hash for
 *     this version, refuse to use a binary that doesn't match.
 *
 * Supported platforms:
 *   - macOS ARM64 (osx-arm64)
 *   - Linux x64 (linux-x64)
 *   - Linux ARM64 (linux-aarch64)
 *   - Windows x64 (win-x64)
 *   - Windows ARM64 (win-arm64)
 *
 * macOS x64 (Intel) is not provided by Microsoft — users must install via:
 *   brew install onnxruntime
 */
import { copyFileSync } from "node:fs";
/** Map (process.platform, process.arch) → ONNX Runtime asset name + library filename */
interface OrtPlatformInfo {
    assetName: string;
    libName: string;
    archiveType: "tgz" | "zip";
}
/** Check if this platform can auto-download ONNX Runtime */
export declare function isOrtAutoDownloadSupported(): boolean;
/** Get the install hint for platforms where auto-download isn't available */
export declare function getManualInstallHint(): string;
/**
 * Ensure ONNX Runtime is available. Returns the directory containing the library,
 * or null if unavailable.
 *
 * Resolution order:
 *   1. Cached in storageDir/onnxruntime/<version>/ (with TOFU verification)
 *   2. System install (brew, apt, etc.)
 *   3. Auto-download from GitHub releases (if platform supported)
 *   4. null (user needs manual install)
 */
export declare function ensureOnnxRuntime(storageDir: string): Promise<string | null>;
/**
 * Sweep abandoned `*.tmp.<pid>.<ts>` staging directories left behind by
 * killed download attempts, and remove an empty/half-populated target dir
 * so the next download retries cleanly. Safe to call before lock acquisition
 * because we only delete dirs whose owning PID is dead (or, on Windows,
 * very old while the owner is still reported alive).
 */
declare function cleanupAbandonedStagingDirs(onnxBaseDir: string): void;
declare function cleanupIncompleteTargetIfUnowned(ortDir: string): void;
declare function cleanupAbandonedOnnxAttempts(onnxBaseDir: string, ortDir: string): void;
declare function parseOnnxVersionFromPath(value: string): string | null;
/**
 * Detect the version of an ONNX Runtime install by walking the directory's
 * library-file suffixes. Microsoft ships `libonnxruntime.so.1.24.4` and
 * symlinks the bare `libonnxruntime.so` at it; on macOS the pattern is
 * `libonnxruntime.1.24.4.dylib`. Returns null only when no version-shaped
 * suffix is present (treat as compatible to avoid false negatives on
 * unconventional installs). Malformed version-shaped suffixes return an invalid
 * sentinel so the system install is rejected instead of silently accepted.
 */
declare function detectOnnxVersion(libDir: string, libName: string): string | null;
declare function isOnnxVersionCompatible(version: string): boolean;
declare function resolveCachedOnnxRuntimeDir(ortVersionDir: string, libName: string): string;
declare function findSystemOnnxRuntime(libName?: string): string | null;
declare function copyOnnxLibraries(info: OrtPlatformInfo, extractedDir: string, targetDir: string, realFiles: string[], symlinks: Array<{
    name: string;
    target: string;
}>, copyFile?: typeof copyFileSync): void;
/**
 * Acquire a process-exclusive lock. Atomic O_EXCL create with PID-aware
 * stale-lock recovery. Mirrors `acquireInstallLock` in lsp-cache.ts but
 * lives here because the ONNX install dir is keyed on `storageDir`,
 * not `lspPackageDir`.
 */
declare function acquireLock(lockPath: string): boolean;
declare function releaseLock(lockPath: string): void;
/**
 * Remove ONNX Runtime from temp files. Cleanup helper for test isolation.
 */
export declare function cleanupOnnxRuntime(storageDir: string): void;
/**
 * Test-only exports. Intentionally not part of the published surface — these
 * are internal helpers we want to exercise from unit tests without forcing
 * an actual ONNX download. Don't use from production code.
 */
export declare const __test__: {
    cleanupAbandonedOnnxAttempts: typeof cleanupAbandonedOnnxAttempts;
    cleanupAbandonedStagingDirs: typeof cleanupAbandonedStagingDirs;
    cleanupIncompleteTargetIfUnowned: typeof cleanupIncompleteTargetIfUnowned;
    copyOnnxLibraries: typeof copyOnnxLibraries;
    resolveCachedOnnxRuntimeDir: typeof resolveCachedOnnxRuntimeDir;
    ORT_VERSION: string;
    ONNX_INSTALLED_META_FILE: string;
    detectOnnxVersion: typeof detectOnnxVersion;
    parseOnnxVersionFromPath: typeof parseOnnxVersionFromPath;
    isOnnxVersionCompatible: typeof isOnnxVersionCompatible;
    findSystemOnnxRuntime: typeof findSystemOnnxRuntime;
    acquireLock: typeof acquireLock;
    releaseLock: typeof releaseLock;
    REQUIRED_ORT_MAJOR: number;
    REQUIRED_ORT_MIN_MINOR: number;
};
export {};
//# sourceMappingURL=onnx-runtime.d.ts.map