import { type SpawnSyncOptions } from 'node:child_process';
import { type GlobalKyroOwnership } from '../invocation';
import type { CliOptions } from '../types';
/**
 * Friendly one-step updater (`kyro update`).
 *
 * Updating used to be two manual steps with implicit knowledge: `npx kyro-ai install` (refresh the
 * global runtime + workspace from the npm package) plus `npm i -g kyro-ai` (move the global shim).
 * Nothing reported whether an update existed, and running install without `@latest` could
 * "update" to the same stale npx cache. This verb folds the flow into one command:
 *
 *  1. Read the running CLI version and the installed runtime version (manifest).
 *  2. Ask the registry for the latest release (`npm view`, fail-soft when offline).
 *  3. Verify that the active `kyro` belongs to the npm global prefix before installing.
 *  4. Confirm interactively (unless `--yes`), then run the package manager with inherited stdio
 *     so progress is visible, and finish by re-running `sync`/`install` from the FRESH package —
 *     never continuing in the old process.
 *
 * Deliberately NOT gated on `requireFullPackageFor`: the check step works from the projected
 * runtime too (often the only CLI agents have), and the mutating steps shell out to a fresh
 * full package either way. A current CLI also syncs a workspace that still has the legacy
 * shared scopes[] cache. For the same reason this verb stays out of `isMutatingInvocation` in
 * app.ts — the spawned fresh CLI takes its own state-writer lock, and a parent-held lock would
 * deadlock the child. `update` delegates state writes to that child.
 */
export declare const UPDATE_PACKAGE = "kyro-ai";
export declare function validateTargetVersion(raw: unknown): string | null;
export interface UpdateFacts {
    current: string;
    latest: string | null;
    runtimeVersion: string | null;
    hasWorkspace: boolean;
    hasLegacyScopeCache: boolean;
    ownership: GlobalKyroOwnership;
}
export type UpdateAction = 'up-to-date' | 'refresh-stale-runtime' | 'refresh-workspace' | 'blocked-runtime-ahead' | 'blocked-runtime-mismatch' | 'ahead-of-registry' | 'update-global' | 'migrate-global' | 'blocked-ownership' | 'registry-unavailable';
export interface UpdatePlan {
    facts: UpdateFacts;
    action: UpdateAction;
    /** Exact version pin; never a floating tag. */
    target: string;
    behind: boolean;
    steps: string[];
    summary: string;
}
/**
 * Pure: no I/O. Decide what `kyro update` should do from the gathered facts.
 * Unit-tested in scripts/check-update.mjs (no network in tests).
 */
export declare function buildUpdatePlan(facts: UpdateFacts): UpdatePlan;
/** Quote one argv element for `cmd.exe` when spawning through a shell on Windows. */
export declare function quoteWinArg(value: string): string;
export interface PackageManagerResult {
    status: number | null;
    stdout: string;
    stderr: string;
    spawnError: string | null;
}
/**
 * Run npm cross-platform. On win32 it is a `.cmd` shim: a direct spawn fails with ENOENT
 * (PATHEXT is ignored without a shell) or EINVAL (direct `.cmd` spawn blocked since
 * CVE-2024-27980), so route through the shell. All arguments are operator-safe (constant package
 * name, validated semver, fixed flags), so shell routing adds no injection surface.
 */
export declare function runPackageManager(bin: 'npm', args: string[], options?: {
    timeout?: number;
    stdio?: SpawnSyncOptions['stdio'];
}): PackageManagerResult;
/** Stream install progress while retaining recent stderr for an actionable failure. */
export declare function installGlobalPackage(target: string): Promise<PackageManagerResult>;
/** Ask the registry for the latest release. Fail-soft: null when offline or unparsable. */
export declare function queryRegistryLatest(): string | null;
/** Read-only probe of the npm prefix/root and the effective command on PATH. */
export declare function probeGlobalKyroOwnership(): GlobalKyroOwnership;
/** Locate the fresh global CLI entrypoint after `npm install -g` (null when absent). */
export declare function resolveFreshGlobalCli(): string | null;
export interface GlobalPackageSnapshot {
    cliJs: string;
    version: string;
}
/** Read the package npm actually installed, never the running projected/old process. */
export declare function readFreshGlobalPackage(): GlobalPackageSnapshot | null;
export type UpdateConsistency = 'consistent' | 'package-missing' | 'package-version' | 'command-ownership' | 'command-version' | 'runtime-version';
/** Pure final gate: success requires one exact version across all three surfaces. */
export declare function assessUpdateConsistency(input: {
    target: string;
    packageVersion: string | null;
    ownership: GlobalKyroOwnership;
    commandVersion: string | null;
    runtimeVersion: string | null;
}): UpdateConsistency;
/** Execute the shell-visible command to detect PATH shadowing or stale shims. */
export declare function readVisibleKyroVersion(): string | null;
/**
 * Refresh the current workspace (or runtime-only when there is none) from a CLI entrypoint,
 * with inherited stdio so progress is visible. Propagates the child exit code.
 */
export declare function refreshFromCli(cliJs: string, hasWorkspace: boolean, verbose: boolean): void;
export declare function runUpdate(options: CliOptions): Promise<void>;
//# sourceMappingURL=update.d.ts.map