/**
 * Apply an update.
 *
 * Apply == reinstall the package globally via `npm install -g <pkg>@<ver>`.
 * Rollback == reinstall the previously-recorded version. Both are dispatched
 * through an injectable `NpmExecutor` so tests don't shell out.
 *
 * Service-host restart is best-effort: the binary swap succeeded even if
 * `systemctl/launchctl/nssm restart` returned non-zero, so the state stays
 * successful and the caller surfaces a warning. (User can restart by hand.)
 */
import { type UpdateApplyResult } from './types.js';
export interface NpmResult {
    exitCode: number;
    stdout: string;
    stderr: string;
}
/** Pluggable npm runner — replaced in tests. */
export type NpmExecutor = (args: string[]) => Promise<NpmResult>;
/** Optional service-host restart hook. Returns undefined on success, an error message on failure. */
export type ServiceRestarter = () => Promise<string | undefined>;
export interface ApplyOptions {
    npmPackage: string;
    fromVersion: string;
    toVersion: string;
    npmExecutor?: NpmExecutor;
    restart?: ServiceRestarter;
    timeoutMs?: number;
}
/**
 * Drive the install + restart. Throws `UpdateErrorException('apply_failed')`
 * if the install itself fails (after attempting rollback). On install
 * success but restart failure, returns a result with the restart error set.
 */
export declare function applyUpdate(opts: ApplyOptions): Promise<UpdateApplyResult>;
/**
 * Default executor: spawn `npm` with the given args. Adds a hard timeout.
 *
 * On Windows, npm ships as `npm.cmd` (a batch file). CreateProcess can't run
 * batch files directly, so a shell is required — but Node's DEP0190 warns
 * against `spawn(cmd, args, { shell: true })` because args are concatenated
 * (not escaped) into the resulting command line. To dodge the deprecation we
 * pre-quote each arg ourselves and pass the result as a single command string
 * with an empty args array. Inputs come from a signed manifest after
 * regex-validated package + semver checks, so injection surface is minimal;
 * quoting is defense in depth.
 */
export declare function defaultNpmExecutor(timeoutMs: number): NpmExecutor;
/**
 * Build the `(command, args, shell)` triple passed to `spawn`. Exported for
 * tests — the spawn shape differs per platform and the quoting matters.
 */
export declare function buildNpmSpawnSpec(args: string[]): {
    command: string;
    args: string[];
    shell: boolean;
};
/** cmd.exe quoting — wrap args containing whitespace or shell metachars. */
export declare function quoteWindowsArg(arg: string): string;