/**
 * Phase 4a — invariants checked on EVERY lockfile read path.
 *
 * The Zod schema (`schema.ts`) catches structural shape errors. This
 * file adds cross-field invariants the schema cannot express:
 *
 *   - `lockfileVersion === 2` (already a literal in the schema, but
 *     re-asserted here so the error message names the offending file)
 *   - `semver.satisfies(resolved.version, spec)` — the resolved pin
 *     must satisfy its spec range
 *   - slug keys must match the shared `validateSlug` regex
 *   - `contentHash.algo === "sha256-v1"` (already a literal, re-checked
 *     so a future migration can grow the union without re-typing the
 *     plan)
 *   - `publishedBy` matches `^\S+@\S+$` (loose email shape — already
 *     in the schema, re-checked for consistency of error reporting)
 *
 * `assertLockInvariants` runs at every read site (load, install,
 * add, update, remove, verify, list_pinned, ...) — not just install.
 * A tampered/corrupt lockfile is detected on first touch.
 */
import { type Lockfile } from "./schema.js";
export declare class LockfileInvariantError extends Error {
    readonly slug?: string | undefined;
    constructor(message: string, slug?: string | undefined);
}
/**
 * Validate that `data` is a well-formed lockfile object AND that all
 * cross-field invariants hold. Throws `LockfileInvariantError` on the
 * first failure with a message that names the offending field/slug.
 *
 * Returns the typed `Lockfile` on success so callers can chain:
 *
 *   const lock = assertLockInvariants(JSON.parse(raw));
 */
export declare function assertLockInvariants(data: unknown): Lockfile;