export declare const META_PROXY_VERSION = "0.4.1";
export declare const META_PROXY_RELEASE_BASE = "https://github.com/cognitum-one/meta-proxy-dist/releases/download";
/** The release signing key, pinned in the client rather than fetched from GitHub. */
export declare const META_PROXY_SIGNING_PUBKEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=\n-----END PUBLIC KEY-----\n";
export interface PlatformAsset {
    target: string;
    archive: 'tar.gz' | 'zip';
    assetName: string;
}
export declare function resolveMetaProxyAsset(platform?: NodeJS.Platform, arch?: string, version?: string): PlatformAsset;
export declare function isValidReleaseVersion(value: string): boolean;
export declare function sha256Hex(bytes: Buffer): string;
export declare function parseSha256Sums(text: string): Map<string, string>;
export declare function verifyMetaProxyChecksum(archive: Buffer, assetName: string, sums: Buffer): boolean;
/** Verify the raw SHA256SUMS bytes against the pinned Ed25519 release key. */
export declare function verifyMetaProxyManifest(sums: Buffer, signatureBase64: string): boolean;
export declare function metaProxyDataDir(home?: string): string;
export declare function metaProxyBinaryPath(platform?: NodeJS.Platform, home?: string): string;
/** Meta-Proxy owns this state directory; MetaHarness reads only the local bearer token. */
export declare function rufloStateDir(home?: string): string;
export declare function metaProxyTokenPath(home?: string): string;
/**
 * Resolve the endpoint that receives the local bearer token. We intentionally
 * support only literal loopback bindings: a user-controlled config must never
 * make `proxy run` disclose a local proxy token to a remote host.
 */
export declare function metaProxyEndpoint(home?: string): string;
/** Environment passed only to the launched client; no token is persisted in a project file. */
export declare function metaProxyClientEnvironment(home?: string): Record<string, string>;
export type WorktreePolicy = 'critical' | 'standard' | 'economy';
/** A stable correlation value, never a filesystem path, prompt, or repo name. */
export declare function worktreeFingerprint(cwd?: string): string;
/**
 * Mint a short-lived policy capability accepted by Meta-Proxy v0.4.0+.
 * The underlying proxy secret remains the HMAC key and is never sent upstream.
 */
export declare function createMetaProxyPolicyToken(proxyToken: string, policy: WorktreePolicy, worktree?: string, now?: number): string;
export interface FetchResponse {
    ok: boolean;
    status: number;
    arrayBuffer(): Promise<ArrayBuffer>;
}
export type Fetcher = (url: string) => Promise<FetchResponse>;
export interface InstallMetaProxyOptions {
    version?: string;
    releaseBase?: string;
    platform?: NodeJS.Platform;
    arch?: string;
    home?: string;
    fetcher?: Fetcher;
}
export interface MetaProxyInstallResult {
    ok: boolean;
    message: string;
    binaryPath?: string;
    version?: string;
}
/** Download, authenticate, extract, and atomically install a Meta-Proxy release. */
export declare function installMetaProxy(options?: InstallMetaProxyOptions): Promise<MetaProxyInstallResult>;
export interface MetaProxyStatus {
    installed: boolean;
    running: boolean;
    binaryPath: string;
    version: string | null;
    pid: number | null;
}
export declare function metaProxyStatus(home?: string, platform?: NodeJS.Platform): MetaProxyStatus;
export declare function startMetaProxy(home?: string, platform?: NodeJS.Platform): MetaProxyInstallResult;
export declare function stopMetaProxy(home?: string): MetaProxyInstallResult;
export declare function runThroughMetaProxy(args: string[], home?: string): Promise<ProxyCommandResult>;
export interface ProxyCommandResult {
    code: number;
    lines: string[];
}
/** `metaharness proxy` command surface. OAuth remains inside the Meta-Proxy binary. */
export declare function metaProxyCmd(args: string[]): Promise<ProxyCommandResult>;
//# sourceMappingURL=meta-proxy.d.ts.map