/**
 * `tools install` — atomic stage → validate → activate (ADR-0041).
 *
 * The candidate stages into a temp host (npm `--ignore-scripts`) and the FULL
 * validation (`runToolValidation`, keepStaged) runs against the staged bytes.
 * Only a `passed` verdict activates — and activation installs a tarball
 * `npm pack`ed FROM THE STAGED DIR, never a re-resolve of the original spec
 * (a registry re-resolve between validate and activate could deliver
 * different bytes than the ones validated; and `npm install <dir>` would
 * symlink the about-to-be-deleted temp host). A failed install leaves no
 * discoverable tool behind: the temp host is removed in `finally` and the
 * scope host is never touched.
 */
import type { ToolsInstallResult } from '@opensip-cli/contracts';
/** Options for {@link toolsInstall}. */
export interface ToolsInstallOptions {
    readonly spec: string;
    readonly cwd: string;
    /** Install into the project `.runtime` tool host instead of user-global. */
    readonly project?: boolean;
}
/**
 * Expected npm-pack tarball basename from package.json identity
 * (`@scope/name` → `scope-name-version.tgz`). Never trust pack stdout alone.
 */
export declare function expectedNpmPackTarballName(packageName: string, version: string): string;
/**
 * Resolve the packed tarball path inside `stagedPkgDir` without trusting
 * attacker-controlled `npm pack` stdout as a path (L7).
 *
 * Preference order:
 * 1. package.json name+version → expected basename (known identity)
 * 2. basename-only of the last pack stdout line, only if it is a bare `.tgz`
 *    name with no path separators / `..` and resolves inside the staged dir
 * @throws {Error} when the pack stdout cannot be safely resolved to a tarball
 *   inside the staged package dir (unsafe path, `..`, or outside the dir).
 */
export declare function resolvePackedTarballPath(stagedPkgDir: string, packStdout: string): string;
/** Stage, validate, and (on a `passed` verdict only) activate one tool package. */
export declare function toolsInstall(opts: ToolsInstallOptions): Promise<ToolsInstallResult>;
//# sourceMappingURL=install.d.ts.map