export declare const DEFAULT_RESOURCE_BASE_URL = "https://releases.aiwg.io";
export declare const AIWG_RELEASE_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA8BsJ2vjuHBReexz328sknfL7MKUtxynX6MGfqFVMD38=\n-----END PUBLIC KEY-----";
export type ResourceSource = "local" | "web" | "auto";
export type ResourceSelector = {
    kind: "exact";
    value: string;
} | {
    kind: "channel";
    value: string;
} | {
    kind: "range";
    value: string;
    normalizedRange: string;
} | {
    kind: "digest";
    value: string;
    digest: string;
};
export interface ResourceFetchResponse {
    ok: boolean;
    status: number;
    headers: {
        get(name: string): string | null;
    };
    body?: {
        getReader(): {
            read(): Promise<{
                done: boolean;
                value?: Uint8Array;
            }>;
            cancel?(reason?: unknown): Promise<void>;
        };
    } | null;
    arrayBuffer(): Promise<ArrayBuffer>;
}
export type ResourceFetcher = (input: string | URL, init?: {
    redirect?: "error";
    headers?: Record<string, string>;
    signal?: AbortSignal;
}) => Promise<ResourceFetchResponse>;
export interface WebReleaseOptions {
    selector?: string;
    offline?: boolean;
    baseUrl?: string;
    cacheRoot?: string;
    publicKeyPem?: string | Buffer;
    fetcher?: ResourceFetcher;
    /** Returns a bearer token at request time. Tokens never participate in URLs or cache keys. */
    credentialProvider?: () => Promise<string | null>;
    /** Test/development escape hatch. HTTP remains restricted to loopback. */
    allowInsecureLoopbackHttp?: boolean;
    /** Structured cache diagnostics; never includes URLs, headers, or credentials. */
    onDiagnostic?: (diagnostic: WebReleaseDiagnostic) => void;
}
export interface WebReleaseDiagnostic {
    resource: "channel" | "version-index";
    outcome: "conditional-hit" | "revalidated" | "unconditional";
    validator: "etag" | "last-modified" | "none";
}
export interface VerifiedReleaseDescriptor {
    path: string;
    size: number;
    sha256: string;
}
export interface VerifiedWebRelease {
    selector: string;
    selectorKind: ResourceSelector["kind"];
    version: string;
    manifestDigest: string;
    baseUrl: string;
    manifestUrl: string;
    cacheDir: string;
    releaseManifestPath: string;
    releaseSignaturePath: string;
    fortemiManifestPath: string;
    fortemiExportPath: string;
    fortemiManifestSha256: string;
    fortemiManifestSize: number;
    fortemiExportSha256: string;
    fortemiExportSize: number;
    channelSequence?: number;
    descriptors: ReadonlyMap<string, VerifiedReleaseDescriptor>;
}
export interface VerifiedRawResourceOptions extends Pick<WebReleaseOptions, "baseUrl" | "fetcher" | "credentialProvider" | "allowInsecureLoopbackHttp"> {
    offline?: boolean;
}
export declare function verifySignedResourceBytes(bytes: Uint8Array, signatureBytes: Uint8Array, publicKeyPem?: string | Buffer, label?: string): string;
export declare function parseResourceSelector(selector: string): ResourceSelector;
export declare function getResourceCacheRoot(cacheRoot?: string): string;
export interface BoundedFileReadOptions {
    label: string;
    maxBytes: number;
    expectedSize?: number;
    expectedSha256?: string;
}
/**
 * Read a bounded regular file through one descriptor. O_NOFOLLOW closes the
 * final-component symlink race on platforms that support it; lstat/fstat and
 * digest checks retain fail-closed behavior elsewhere.
 */
export declare function readVerifiedRegularFile(pathname: string, options: BoundedFileReadOptions): Buffer;
export declare function loadResourceTrustRootFile(pathname: string): Buffer;
export declare function resolveWebRelease(options?: WebReleaseOptions): Promise<VerifiedWebRelease>;
export declare function fetchVerifiedRawResource(release: VerifiedWebRelease, resourcePath: string, options?: VerifiedRawResourceOptions): Promise<Buffer>;
export declare function createWebReleaseTestOptions(baseUrl: string, overrides?: Omit<WebReleaseOptions, "baseUrl" | "allowInsecureLoopbackHttp">): WebReleaseOptions;
//# sourceMappingURL=web-release.d.ts.map