/**
 * Integrity verification for bytes downloaded on first run. Reads
 * models.lock.json from the package root and compares SHA-256 of the
 * fetched buffer against the recorded hash.
 *
 * Why: sverklo claims "code never leaves the machine," but the bytes
 * that INTERPRET your code (the ONNX embedding model + every
 * tree-sitter grammar WASM) are downloaded from third-party CDNs on
 * first run. A CDN compromise or DNS hijack at install time would
 * land attacker bytes into onnxruntime / web-tree-sitter. Architectural
 * review 2026-05-13 (Tier 3.2) flagged this as a HIGH severity gap.
 *
 * The 4-byte WASM magic check that grammars-install.ts already had is
 * a shape check, not an authenticity check — a malicious WASM still
 * starts with `\0asm`.
 */
interface ModelLock {
    version: number;
    model: Record<string, {
        url: string;
        sha256: string;
        bytes?: number;
    }>;
    grammars: Record<string, {
        url: string;
        sha256: string;
    }>;
}
export declare function loadModelLock(): ModelLock | null;
/**
 * Compute SHA-256 of a buffer, hex-encoded lowercase.
 */
export declare function sha256Hex(buf: Buffer | Uint8Array): string;
/**
 * Verify downloaded bytes match the recorded hash. Throws on mismatch
 * with a clear, user-actionable remediation message.
 *
 * If the lock file isn't present (dev checkout, mis-packaged install)
 * this is a soft warning, not a refusal — but we log a one-liner to
 * stderr so the gap is visible.
 */
export declare function verifyArtifact(category: "model" | "grammars", filename: string, buf: Buffer | Uint8Array, options?: {
    strict?: boolean;
    allowMissingLock?: boolean;
}): void;
export {};