/**
 * Pattern Download Service
 * Secure download and verification of patterns from IPFS
 */
import type { PatternEntry, DownloadOptions, DownloadResult, StoreConfig } from './types.js';
/**
 * Download progress callback
 */
export type DownloadProgressCallback = (progress: {
    bytesDownloaded: number;
    totalBytes: number;
    percentage: number;
}) => void;
/**
 * Pattern Downloader
 * Handles secure download and verification of patterns
 */
export declare class PatternDownloader {
    private config;
    private downloadCache;
    constructor(config?: Partial<StoreConfig>);
    /**
     * Download a pattern from IPFS
     */
    downloadPattern(pattern: PatternEntry, options?: DownloadOptions, onProgress?: DownloadProgressCallback): Promise<DownloadResult>;
    /**
     * Fetch content from IPFS gateway or GCS
     */
    private fetchFromIPFS;
    /**
     * Fetch a single URL with a hard timeout and a byte cap (#4750). The timeout
     * aborts the request; the byte cap aborts mid-stream once exceeded. Both
     * protect against a registry serving a hung or oversized response.
     */
    private fetchBounded;
    /**
     * Fetch content from Google Cloud Storage
     */
    private fetchFromGCS;
    /**
     * Verify content checksum
     */
    private verifyChecksum;
    /**
     * Verify an Ed25519 signature over the content. Any error is a failure.
     */
    private verifySignature;
    /**
     * Resolve the Ed25519 public key a pattern's signature must verify against
     * (#4750). Returns whether the key is *pinned* (came from the operator's
     * config.trustedRegistryPublicKeys) or merely the entry's own self-declared
     * publicKey. Callers that enforce verification must treat a self-declared key
     * as untrusted: otherwise a malicious registry entry can sign its own content
     * with its own key and pass (the exact gap #4750 was filed to close).
     */
    private resolveVerificationKey;
    /**
     * Thin wrapper kept for callers that only need a usable key.
     */
    private resolveTrustedPublicKey;
    /**
     * Sanitize a pattern's name/version and assert the resulting path stays inside
     * the cache directory before anything is written (#4750).
     */
    private sanitizeAndAssertOutput;
    /**
     * Resolve output path for pattern
     */
    private resolveOutputPath;
    /**
     * Import downloaded pattern
     */
    private importPattern;
    /**
     * Clear download cache
     */
    clearCache(): void;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        count: number;
        totalSize: number;
    };
}
/**
 * Batch download multiple patterns
 */
export declare function batchDownload(patterns: PatternEntry[], options?: DownloadOptions, config?: Partial<StoreConfig>): Promise<DownloadResult[]>;
/**
 * Create downloader with default config
 */
export declare function createDownloader(config?: Partial<StoreConfig>): PatternDownloader;
//# sourceMappingURL=download.d.ts.map