/**
 * Post-CLI-upgrade lockfile normalization for the dev-server pod's globally
 * installed Superblocks CLI.
 *
 * npm honors `resolved` URLs verbatim, so a tarball whose bundled lockfile
 * entries point at `registry.npmjs.org` keeps fetching from public npm even
 * after we've written a private `.npmrc`. This module strips those URLs
 * post-upgrade so subsequent installs re-resolve through the active registry.
 *
 * In the dev-server image the CLI is a pnpm global install instead. There
 * the strip removes the `tarball:` URLs from that install's pnpm-lock.yaml,
 * which pnpm itself locates.
 *
 * The walk from the resolved `superblocks` binary up to the CLI package root
 * is bounded so a misconfigured layout can never mutate arbitrary lockfiles
 * on the filesystem.
 *
 * All failures are logged and swallowed — a failed post-strip must not crash
 * the pod after a working upgrade. The next dev startup repeats the strip
 * idempotently.
 */
import { type Logger } from "../telemetry/logging.js";
/**
 * Injectable subset of `child_process.exec` so tests can stub the
 * `which`/`where` lookup without spawning a real subprocess.
 */
type WhichRunner = (binary: string) => Promise<string>;
/**
 * Discovers the absolute path of the `@superblocksteam/cli` install root
 * (the directory containing the CLI's `package.json`), or returns `undefined`
 * if discovery fails. Discovery failures are non-fatal — the caller logs and
 * skips the strip rather than aborting.
 */
export declare function findGlobalCliInstallDir(logger: Logger, whichRunner?: WhichRunner): Promise<string | undefined>;
/**
 * Prints `pnpm list -g --json`. Injectable so tests need no real pnpm.
 * `--silent` keeps pnpm's warnings (for example about the app's
 * `packageManager` field) out of the JSON on stdout.
 */
type PnpmListRunner = () => Promise<string>;
/**
 * Finds the pnpm-lock.yaml of the pnpm global install that holds the CLI.
 * pnpm gives every global install its own directory,
 * `<global>/<hash>/node_modules/@superblocksteam/cli`, with the lockfile in
 * `<hash>`. The dev-server image always installs the CLI under the
 * `@superblocksteam/cli` name, also for the ephemeral alias.
 */
export declare function findPnpmGlobalCliLockfile(logger: Logger, pnpmListRunner?: PnpmListRunner): Promise<string | undefined>;
interface StripUpgradedCliLockfilesOptions {
    /**
     * Pre-resolved install root. If omitted, `findGlobalCliInstallDir` is used.
     * Tests pass this directly to avoid stubbing `which`.
     */
    installDir?: string;
    whichRunner?: WhichRunner;
    pnpmListRunner?: PnpmListRunner;
    /**
     * Override the strip timeout (ms). Tests use a tight value to exercise the
     * timeout branch without sleeping for the real bound.
     */
    timeoutMs?: number;
}
/**
 * Strips public-host `resolved` URLs from every lockfile under the global
 * CLI install that the auto-upgrade could have refreshed. Returns the
 * resolved install root on success, or `undefined` when discovery failed.
 *
 * Non-fatal: every individual strip already swallows lockfile-level errors
 * (logged in `stripResolvedFromLockfilePath`); this wrapper additionally
 * swallows discovery failures and any unexpected throw from the inner
 * helpers so a successful upgrade is never demoted to a crash by a post-step
 * problem.
 */
export declare function stripUpgradedCliLockfiles(logger: Logger, options?: StripUpgradedCliLockfilesOptions): Promise<{
    installDir?: string;
}>;
export {};
//# sourceMappingURL=post-upgrade-lockfile-strip.d.mts.map