/** hex sha256 of a file's contents (shared by the runtime verify and the `sigdb-remote` pointer generator) */
export declare const sha256File: (p: string) => string;
/** the committed link file naming every downloadable shard (base floor + CRAN sets); only this pointer is committed */
export declare const SigDbRemoteFileName = "sigdb.remote.json";
/** one downloadable shard as recorded in the committed {@link SigDbRemoteFileName} link file */
export interface RemoteShard {
    sha256: string;
    bytes: number;
}
/** the committed link file: the release tag + repo plus every downloadable shard's integrity hash + size */
export interface SigDbRemote {
    format?: string;
    schema?: number;
    tag: string;
    repo?: string;
    shards: Record<string, RemoteShard>;
}
/**
 * Group physical asset names by their logical (compression-ext-stripped) name and pick, per logical shard, the
 * single best variant this runtime can use: `.zst` when zstd is supported, otherwise `.br` (then `.gz`/plain).
 * On a Node without zstd, a `.zst`-only logical shard is skipped entirely (it could not be decompressed). So the
 * downloader fetches exactly one variant per shard/dictionary -- never both -- matching what the reader resolves.
 */
export declare function selectDownloadVariants(names: Iterable<string>): string[];
export interface SigDbDownloadOptions {
    /** GitHub `owner/repo` (default `flowr-analysis/flowr`) */
    readonly repo?: string;
    /** release version, i.e. tag `sigdb-v<version>` (default the running flowR version); ignored when the committed `sigdb.remote.json` is present, whose `tag` then drives the download */
    readonly version?: string;
    /** progress callback (one line per asset) */
    readonly onProgress?: (msg: string) => void;
    readonly force?: boolean;
}
export interface SigDbDownloadResult {
    /** the directory the bundle landed in (add it to `solver.sigdb.additionalPaths` to keep it mounted) */
    readonly dir: string;
    /** the manifest to mount (richest scope), or `undefined` if the release ships only standalone bundles */
    readonly manifest: string | undefined;
    /** every downloaded file */
    readonly files: readonly string[];
}
/**
 * Download the signature-database shards into the cache directory and return where they landed. Prefers the
 * committed `sigdb.remote.json`, we verify each download by content hash, and **skip shards already
 * present with the right hash**.
 * Use the returned {@link SigDbDownloadResult.manifest}, or point `solver.sigdb.additionalPaths` at the dir.
 */
export declare function downloadFullSigDb(opts?: SigDbDownloadOptions): Promise<SigDbDownloadResult>;
/**
 * The cache dir a {@link downloadFullSigDb} for the committed link file would populate, or `undefined` if no
 * pointer is committed. Lets a caller mount an already-synced bundle via `solver.sigdb.additionalPaths` without
 * hitting the network.
 */
export declare function syncedSigDbDir(): string | undefined;
/** the GitHub release (`{repo, tag, url}`) the committed pointer downloads from, or `undefined` when no pointer is committed */
export declare function sigDbRemoteRelease(): {
    repo: string;
    tag: string;
    url: string;
} | undefined;
/** Fast presence check (existence + byte size only, no hashing) for the shards the committed pointer selects for this runtime; `false` when no pointer is committed or any selected shard is missing/wrong-size. */
export declare function sigDbCacheComplete(): boolean;
/** Startup check: `true` when a committed link file lists shards whose cached copies are missing or hash-mismatched */
export declare function sigDbNeedsSync(): boolean;