import type { CodePins } from './optional-deps-locks.js';
/** The machine the SDK picks a Claude binary for. */
export interface PinHost {
    platform: NodeJS.Platform;
    arch: string;
    /** Linux libc; detected like the SDK does when omitted. */
    musl?: boolean;
}
/** SHA-256 of `file`, read in 4 MB chunks. Synchronous, as before this
 *  hashing existed the load had no long I/O step: hashing the Claude binary
 *  (about 300 MB) blocks for a few hundred milliseconds once per process.
 *  An asynchronous hash was tried and let timers in the session code and its
 *  tests run in the middle of the first SDK load. */
export declare function sha256File(file: string): Promise<string>;
/** `<package>/claude[.exe]` specifiers in the order the SDK tries them
 *  (claude-agent-sdk 0.3.226: the first that resolves and exists wins). */
export declare function claudeBinaryCandidates(host: PinHost): string[];
export declare const verifiedBinary: (name: string) => {
    path: string;
    sha256: string;
} | undefined;
/** Throws unless `file` is unchanged (same inode, size, mtime and ctime)
 *  since it was verified against `sha256`: one stat, no rehash. */
export declare function assertStillVerified(file: string, sha256: string): void;
/**
 * Throws unless the entry `entry` of `name` (installed in `pkgDir`) is the
 * pinned file with the pinned hash, and, when the pins list binaries and
 * `checkBinary` holds, the Claude binary the SDK would spawn from there is
 * one of them with its hash; that one is then recorded (verifiedBinary).
 * `remove` is what to delete to recover, for the message.
 *
 * The entry is imported by path after this returns, so a file swapped in
 * the few milliseconds between the hash and the import would run. Roles
 * cannot write the deps dir (the SDK sandbox's denyWrite, the mask's
 * read-only bind), so only an unsandboxed process could race it, and that
 * one could as well replace monomind itself.
 */
export declare function verifyPinnedCode(name: string, pins: CodePins, where: {
    entry: string;
    pkgDir: string;
    remove: string;
    checkBinary?: boolean;
}, host: PinHost, fail: (message: string) => never): Promise<void>;
/** Fails (via `refuse`, with the reason) when a directory above `root` is a
 *  symlink in a directory this user can write: see the module doc. */
export declare function assertNoSymlinkAncestor(root: string, refuse: (why: string) => never): void;
/** Forgets what was verified (tests). */
export declare function resetPinnedCodeCache(): void;
//# sourceMappingURL=optional-deps-verify.d.ts.map