/**
 * Lazy download + integrity-verified caching of the native gsk-mesh binary.
 *
 * Cache layout under ~/.genspark-tool-cli/bin/ :
 *   gsk-mesh[.exe]        the native binary
 *   .gsk-mesh-version     the version string the binary was installed at
 *   .gsk-mesh-sha256      the expected sha256 for that binary
 *
 * Security note (per-run integrity check — gen-spark#32059): a cached binary
 * is exec'd directly on every `gsk mesh ...`, so a local process that can write
 * to bin/ could otherwise plant code that runs as the user. On every cache hit
 * we re-hash the file and compare:
 *   - if it's still at PINNED_VERSION, the expected sha is CHECKSUMS[target],
 *     which is compiled into the published @genspark/cli (tamper-resistant);
 *   - otherwise (upgraded past the pin via `gsk mesh upgrade`), we compare
 *     against the .gsk-mesh-sha256 stamp.
 * A mismatch re-downloads the pinned version rather than exec'ing a binary we
 * can't vouch for.
 */
/** True if a gsk-mesh binary is already cached for the current target. */
export declare function isMeshInstalled(): boolean;
/** The version string the cached binary was installed at, or null. */
export declare function getInstalledMeshVersion(): string | null;
/**
 * Ensure the native gsk-mesh binary is present, current, and intact.
 * Returns the absolute path to the verified binary.
 *
 * `baseUrlOverride` (the CLI `--base-url`) is threaded through to the first-run
 * latest-version probe so it targets the same backend as the rest of the CLI.
 */
export declare function ensureMeshBinary(baseUrlOverride?: string): Promise<string>;
/**
 * Download a specific version+target from `url`, verify its sha256, install it
 * atomically, and update the version/sha stamps. Shared by first-run
 * (`ensureMeshBinary`) and `gsk mesh upgrade` (which passes a newer version).
 */
export declare function downloadAndInstall(url: string, expectedSha: string, version: string, target: string): Promise<void>;
//# sourceMappingURL=download.d.ts.map