/**
 * Probes the GitHub releases API for a project's tagged releases and
 * selects the newest tag whose asset publication satisfies AFT's
 * supply-chain grace window.
 *
 * Same threat model as the npm registry probe — we want releases that
 * have been observable for at least `graceDays` so the community has
 * time to detect compromised tarballs and yank them.
 *
 * For repos that put release tags on a `published_at` field (almost
 * all of them), we filter on that. Pre-releases are skipped by default.
 */
interface GithubRelease {
    tag_name: string;
    name?: string;
    published_at?: string;
    draft?: boolean;
    prerelease?: boolean;
    assets?: Array<{
        name: string;
        browser_download_url: string;
        size?: number;
    }>;
}
export interface GithubVersionPickResult {
    /** Chosen release tag (e.g. "v21.1.0" or "21.1.0"), or null if none qualifies. */
    tag: string | null;
    /** Asset list of the chosen release — used to find the right archive. */
    assets: Array<{
        name: string;
        url: string;
        size?: number;
    }>;
    /** True when releases exist but none is older than `graceDays`. */
    blockedByGrace: boolean;
}
/**
 * Pick the newest non-draft non-prerelease release whose `published_at`
 * is at least `graceDays` ago.
 *
 * The GitHub `/releases` endpoint returns up to 30 releases sorted newest
 * first by default — pagination ignored because servers we care about
 * cycle stable releases on the order of weeks/months.
 */
export declare function pickEligibleRelease(releases: readonly GithubRelease[], graceDays: number, now?: number): GithubVersionPickResult;
/**
 * Fetch the GitHub releases list for `owner/repo` and apply the grace filter.
 *
 * Returns `null` on HTTP/network failure — caller should keep using whatever's
 * already cached.
 */
export declare function probeGithubReleases(githubRepo: string, graceDays: number, fetchImpl?: typeof fetch): Promise<GithubVersionPickResult | null>;
/**
 * Throw if `version` contains anything outside the safe allowlist.
 *
 * Call this at every boundary where a version string is about to be
 * concatenated into a path, command, or URL — defense-in-depth even
 * when the surrounding code uses execFile (no shell).
 */
export declare function assertSafeVersion(version: string): void;
/**
 * Non-throwing version of {@link assertSafeVersion}. Returns true when
 * `version` is a non-null, non-empty string that matches the allowlist.
 *
 * Callers that read version strings from disk caches
 * (where corruption is possible but not necessarily an attack) prefer
 * this over throwing — they degrade to "treat as cache miss" instead of
 * crashing the plugin.
 */
export declare function isSafeVersion(version: string | null | undefined): version is string;
/**
 * Strip a leading `v` from a release tag to get a clean version for asset
 * templates that don't include the `v` prefix.
 *
 * The returned value is asserted safe via {@link assertSafeVersion} so
 * callers can pass it into paths and command arguments without
 * additional validation.
 */
export declare function stripTagV(tag: string): string;
export {};
//# sourceMappingURL=lsp-github-probe.d.ts.map