/**
 * `tools validate` — user-invocable tool conformance (ADR-0041).
 *
 * The SAME admission pipeline bootstrap runs (`admitToolPackage` — one
 * validator, four consumers), rendered as a sectioned report, plus the
 * Tier A storage-contract scan (ADR-0042) and the config-contract checks.
 *
 * EXECUTION MODEL (the trust posture, stated plainly): validating a package
 * is trusting it to execute — the runtime sections import the candidate's
 * module. Mitigations, not promises: staging installs run npm with
 * `--ignore-scripts` (install-time hooks never fire), and the module import
 * happens in a child-process probe with a hard timeout (a crash boundary,
 * NOT a security boundary).
 *
 * Staging: an npm/tarball spec installs into a TEMP host dir (removed in
 * `finally`); a local directory path validates IN PLACE by default, or via a
 * temp-host install with `--install-deps` (which also resolves the package's
 * dependencies so the runtime sections can load it).
 */
import type { ToolsValidateResult } from '@opensip-cli/contracts';
/** The one-line execution notice printed before any candidate code can run. */
export declare const VALIDATE_EXECUTION_NOTICE: string;
/** Options for {@link runToolValidation}. */
export interface ToolValidationOptions {
    /** Package spec: npm name/range/tarball/git spec, or a local directory path. */
    readonly spec: string;
    readonly cwd: string;
    /** For LOCAL PATH specs: stage via temp-host npm install (resolves deps). */
    readonly installDeps?: boolean;
}
/**
 * Run every validation section against one candidate spec. Shared by
 * `tools validate` (renders it) and `tools install` (gates activation on it).
 * `keepStaged` hands ownership of the staged dir to the caller (install
 * activates from the validated bytes — never a re-download).
 */
export declare function runToolValidation(opts: ToolValidationOptions, { keepStaged }?: {
    keepStaged?: boolean;
}): Promise<{
    result: ToolsValidateResult;
    stagedPkgDir?: string;
    cleanup: () => void;
}>;
//# sourceMappingURL=validate.d.ts.map