import { defaultIdentity } from '../orgrt/sandbox-stubs-ledger.js';
import { type CodePins } from './optional-deps-locks.js';
import { type PinHost } from './optional-deps-verify.js';
export declare const OPTIONAL_DEPENDENCIES: {
    readonly '@anthropic-ai/claude-agent-sdk': {
        readonly version: '0.3.303';
        readonly size: 'about 300 MB, nearly all of it the native Claude binary';
        readonly feature: 'The Claude runtime (Claude org roles, `agent exec --runtime claude`)';
    };
    readonly '@puppeteer/browsers': {
        readonly version: '3.0.6';
        readonly size: 'about 2 MB';
        readonly feature: 'The Chrome download for `monomind browse`';
    };
    readonly 'monofence-ai': {
        readonly version: '2.24.0';
        readonly size: 'under 1 MB';
        readonly feature: 'MonoFence (the monofence_* MCP tools, `security defend`, org role fences)';
    };
};
export type OptionalDependencyName = keyof typeof OPTIONAL_DEPENDENCIES;
export declare const NO_AUTO_INSTALL_ENV = "MONOMIND_NO_AUTO_INSTALL";
/** The operator's command that installs the Claude Agent SDK outside any org
 *  role (commands/deps.ts, #559). */
export declare const DEPS_INSTALL_COMMAND = "monomind deps install";
/** A missing dependency that was not (or could not be) installed. */
export declare class OptionalDependencyError extends Error {
    name: string;
}
type Env = NodeJS.ProcessEnv;
type Log = (line: string) => void;
export type NpmRunner = (args: string[], cwd: string, env: Env) => Promise<void>;
type Host = PinHost;
export interface EnsureOptions {
    env?: Env;
    /** Resolves `name` from monomind's own module graph to its entry file.
     *  Tests replace it. */
    resolveOwn?: (name: string) => string;
    runNpm?: NpmRunner;
    log?: Log;
    /** For the SDK's platform-package check; tests replace it. */
    host?: Host;
    /** The hashes loaded code must match (#526); tests replace them. */
    pins?: Partial<Record<string, CodePins>>;
    /** #522: an installed Claude Code runs instead of the SDK's bundled
     *  binary, so the SDK is installed without its platform package
     *  (`--omit=optional`), and an install that lacks it counts as installed. */
    withoutSdkBinary?: boolean;
    /** Appended to the install notice. */
    note?: string;
    /** The operator asked for this install (`monomind deps install`), so
     *  MONOMIND_NO_AUTO_INSTALL does not stop it. */
    requested?: boolean;
    /** Install into the deps cache even when monomind resolves the pinned copy itself (a checkout's own
     *  node_modules, say). `monomind deps install` sets it: an org role's sandbox can only use the cache,
     *  so a copy that merely sits in the operator's checkout is not what the operator asked for. */
    intoCache?: boolean;
}
export declare function autoInstallDisabled(env?: Env): boolean;
export declare function monomindHome(env?: Env, home?: string): string;
export declare function depsRoot(env?: Env, home?: string): string;
/** Creates the deps root (owner-only) if missing. The authority mask and the
 *  SDK sandbox bind it read-only, which needs it to exist. */
export declare function ensureDepsRoot(env?: Env, home?: string): string;
/** The deps root for a sandbox to protect, created if possible. When this
 *  process cannot create it, a role running as the same user cannot either,
 *  so there is nothing to protect yet. */
export declare function protectableDepsRoot(env: Env, home: string): string | undefined;
export declare function dependencyDir(name: OptionalDependencyName, env?: Env): string;
/** Single-quotes `s` for a POSIX shell. */
export declare const shellQuote: (s: string) => string;
/** The command that performs the same install by hand. */
export declare function manualInstallCommand(name: OptionalDependencyName, env?: Env, withoutSdkBinary?: boolean): string;
export declare function isInstalled(name: OptionalDependencyName, dir: string, host?: Host, withoutSdkBinary?: boolean): boolean;
/** Whether `name` loads without an install (#559): monomind resolves the
 *  pinned copy itself, or the deps dir holds a complete one. The pins are
 *  checked when it loads. */
export declare function optionalDependencyPresent(name: OptionalDependencyName, opts?: Pick<EnsureOptions, 'env' | 'resolveOwn' | 'host' | 'withoutSdkBinary'>): boolean;
/**
 * Throws unless `entry` (a directory under `root`) is safe to load code
 * from: `root`, every directory between it and `entry`, and `entry` itself
 * are real directories (not symlinks); everything inside is owned by this
 * user and not group- or other-writable; and a symlink inside (npm's `.bin`
 * links, macOS framework links) resolves to a path inside `entry`.
 */
export declare function assertTrustedTree(root: string, entry: string): void;
/** Removes group/other write from everything monomind just installed, so a
 *  permissive umask (002) does not make its own install fail the check. */
export declare function hardenTree(p: string): void;
/**
 * Loads one of OPTIONAL_DEPENDENCIES, installing it into monomind's deps
 * directory first if needed (see the file header).
 */
export declare function ensureOptionalDependency<T = unknown>(name: OptionalDependencyName, opts?: EnsureOptions): Promise<T>;
/**
 * Populates `finalDir` exactly once across processes: `populate` fills a
 * fresh staging directory beside it, which is then renamed into place. A
 * `finalDir` that exists but fails `isDone` (an interrupted manual install)
 * is replaced; one that became done meanwhile is kept and the staging copy
 * discarded.
 */
export declare function installOnce(finalDir: string, isDone: (dir: string) => boolean, populate: (stagingDir: string) => Promise<void>, log?: Log): Promise<void>;
export type LockIdentity = Pick<typeof defaultIdentity, 'pidNamespace' | 'bootId'>;
/** Whether the owner recorded in `lockDir` is gone. A pid is judged only in
 *  our own pid namespace and boot: an org role's sandbox has its own pid
 *  namespace, where the daemon's pid always looks dead, and the reverse. */
export declare function lockIsStale(lockDir: string, id?: LockIdentity): boolean;
export {};
//# sourceMappingURL=optional-deps.d.ts.map