import * as fs from "node:fs";
export { extractTarGz, extractZip } from "./archive.js";
/**
 * Download a URL and write the response body to a file. Follows redirects
 * (GitHub releases redirect to S3). Resolves when the download completes;
 * rejects on HTTP error or network failure.
 */
export declare function download(url: string, dest: fs.PathLike, fetchImpl?: typeof fetch): Promise<void>;
/**
 * Download a URL and return the body as a string. Used for small text
 * files like checksums.txt.
 */
export declare function downloadText(url: string, fetchImpl?: typeof fetch): Promise<string>;
/**
 * Compute the SHA256 hash of a file, returned as lowercase hex.
 */
export declare function sha256File(p: string): Promise<string>;
/**
 * Parse a `checksums.txt` file (the standard GitHub Release format) into a
 * map of {filename → sha256-hex}. Lines look like:
 *   <sha256-hex>  <filename>
 * Lines that don't match are skipped.
 */
export declare function parseChecksums(text: string): Map<string, string>;
/**
 * Verify that a file's SHA256 matches the expected hash. Throws if the
 * hash does not match.
 */
export declare function verifyChecksum(archivePath: string, expectedSha256: string): Promise<void>;
/**
 * Parse a `signature.bin` file (same line format as `checksums.txt`) into a
 * map of {filename → hex-signature}. Lines look like:
 *   <hex-signature>  <filename>
 * The signature is a 128-hex-char (64-byte) Ed25519 signature.
 */
export declare function parseSignatures(text: string): Map<string, string>;
/**
 * Verify that a file's Ed25519 signature matches using the embedded public
 * key. Throws if the signature is missing, malformed, or invalid.
 */
export declare function verifySignature(archivePath: string, signatureHex: string, publicKeyHex: string): Promise<void>;