import type { ConfiguredCliRegistration } from './registration.js';
/** Result of a successful manifest fetch. */
export interface FetchSuccess {
    status: 200;
    raw: Uint8Array;
}
/** Typed failures from manifest fetch. */
export type FetchResult = FetchSuccess | FetchFailure;
export interface FetchFailure {
    status: 'auth_env_missing' | 'cli_unreachable' | 'cli_protocol_error';
    message: string;
}
/**
 * Fetch a configured CLI manifest from the registered endpoint.
 *
 * Implements the core authenticated GET primitive for T0/T2/T4 fetches:
 * - Reads bearer token from `authEnvVar` env var at invocation time
 * - Fails with `auth_env_missing` USAGE before network if env var is named but empty
 * - Performs one GET request with `Accept: application/json` header
 * - Attaches `Authorization: Bearer <token>` header when auth var is configured
 * - A single 10-second socket-inactivity timeout (Node's `timeout` option) covers
 *   the whole request — there is no separate connect clock and no 30s total cap;
 *   that two-clock model belongs to the invoker's per-leaf HTTP calls (§6.6), not
 *   this simpler manifest-fetch primitive.
 * - Returns exact response bytes on 2xx success
 * - Returns typed `cli_unreachable` NETWORK on transport/timeout failures
 * - Returns typed `cli_protocol_error` GENERAL on non-2xx without parseable error body
 *
 * No retries, no conditional request (ETag/If-None-Match), no 304 handling.
 */
export declare function fetchConfiguredCliManifest(registration: ConfiguredCliRegistration): Promise<FetchResult>;
/**
 * Explicit refresh: unconditional fetch and replace stored manifest.
 *
 * Called when user runs `crtr pkg cli refresh <name>`. Always fetches
 * regardless of cache state, and replaces stored manifest on success.
 * On failure, preserves existing cache and throws CrtrError.
 *
 * Returns the raw manifest bytes on success.
 */
export declare function refreshConfiguredCli(registration: ConfiguredCliRegistration): Promise<Uint8Array>;
/**
 * Register-time fetch: fetch and store manifest during registration.
 *
 * Called when user runs `crtr pkg cli register`. Performs one authenticated
 * GET and stores exact bytes. On failure, preserves any prior cached manifest
 * and returns the error (does not throw).
 *
 * Returns a discriminated result: success with bytes, or typed failure.
 */
export declare function registerFetchConfiguredCli(registration: ConfiguredCliRegistration): Promise<FetchSuccess | FetchFailure>;