/**
 * vendor-manifest.ts — per-file SHA-256 hash manifest for the vendored
 * skill-creator directory. Used by preflight to detect mutation or tampering.
 *
 * Two public entry points:
 *   regenerateVendoredManifest(vendorDir)  — rewrite vendored.manifest.json
 *   verifyVendoredManifest(vendorDir)      — returns false on any mismatch
 */
import { z } from 'zod';
/** Maps forward-slash relative path → sha256 hex. */
export declare const VendoredManifestSchema: z.ZodObject<{
    files: z.ZodRecord<z.ZodString, z.ZodString>;
}, "strict", z.ZodTypeAny, {
    files: Record<string, string>;
}, {
    files: Record<string, string>;
}>;
export type VendoredManifest = z.infer<typeof VendoredManifestSchema>;
/**
 * Walk `vendorDir`, hash every file (excluding the manifest itself), and
 * write `vendorDir/vendored.manifest.json` with a `{ files: Record<string,string> }`
 * shape.
 *
 * Deterministic: files are sorted lexicographically; keys are forward-slash
 * relative paths from `vendorDir`.
 */
export declare function regenerateVendoredManifest(vendorDir: string): void;
/**
 * Verify the integrity of `vendorDir` against its stored manifest.
 *
 * Fail-closed: returns `false` when:
 *   - `vendored.manifest.json` is absent or unparseable
 *   - Any listed file is missing on disk
 *   - Any listed file's current hash differs from the stored hash
 *   - Any on-disk file (other than the manifest itself) is NOT listed in the
 *     manifest — an extra/injected file is treated as tampering, not allowed.
 */
export declare function verifyVendoredManifest(vendorDir: string): boolean;
//# sourceMappingURL=vendor-manifest.d.ts.map