/**
 * Package registry client -- search, resolve, and install from remote registries.
 *
 * Queries the MCP registry (registry.modelcontextprotocol.io) and future skill
 * registries to find packages, then resolves them into installable entries
 * with transport, runtime, and argument metadata.
 */
import type { RegistryType, RegistryConfig, McpServerEntry, SkillEntry, RegistrySearchResult, ResolvedPackage } from './types.js';
export declare function validatedNpmSpec(spec: string): string;
export declare function validatedPyPISpec(spec: string): string;
/** Get all registries of a given type, merging defaults with user overrides. */
export declare function getRegistries(type: RegistryType): Record<string, RegistryConfig>;
/** Get only the enabled registries of a given type. */
export declare function getEnabledRegistries(type: RegistryType): Array<{
    name: string;
    config: RegistryConfig;
}>;
/** Add or update a registry configuration in agents.yaml. */
export declare function setRegistry(type: RegistryType, name: string, config: Partial<RegistryConfig>): void;
/** Remove a user-configured or seeded registry. Returns false if it did not exist. */
export declare function removeRegistry(type: RegistryType, name: string): boolean;
/** Search MCP registries for servers matching a query string. */
export declare function searchMcpRegistries(query: string, options?: {
    registry?: string;
    limit?: number;
}): Promise<RegistrySearchResult[]>;
/**
 * Convert an MCP server registry entry into an install spec suitable for
 * writing into `manifest.mcp`. Returns `null` if the entry has no package we
 * know how to launch (e.g. only remote endpoints, which the current manifest
 * shape supports via `url`+`transport: 'http'` but isn't yet wired to the
 * registry's `remotes` field).
 *
 * Supported package shapes:
 *   - npm / runtime=node      → `npx -y <name>`
 *   - pypi / runtime=python   → `uvx <name>`
 *   - runtime=docker          → `docker run --rm -i <name>`
 *   - runtime=binary          → `<name>` (assumed to be on PATH)
 */
export declare function mcpEntryToInstallSpec(entry: McpServerEntry): {
    command?: string;
    url?: string;
    transport: 'stdio' | 'http';
} | null;
/** Look up detailed info for an MCP server by exact name. */
export declare function getMcpServerInfo(serverName: string, registryName?: string): Promise<McpServerEntry | null>;
/** One row of a skill index document. */
export interface SkillIndexEntry {
    name: string;
    description?: string;
    source?: string;
    identifier?: string;
    trust_level?: string;
    repo?: string;
    path?: string;
    tags?: string[];
    author?: string;
    installs?: number;
    /** Lowercase hex sha256 of the skill's SKILL.md supplied by the registry index. */
    sha256?: string;
}
/** Raw shape of the skill index document served by Hermes and compatible registries. */
export interface SkillIndexDocument {
    version?: number;
    generated_at?: string;
    skill_count?: number;
    skills: SkillIndexEntry[];
}
/** Map a raw skill-index row into the canonical SkillEntry shape. */
export declare function normalizeSkillEntry(raw: SkillIndexEntry): SkillEntry;
/** Search skill registries for entries matching a query string. */
export declare function searchSkillRegistries(query: string, options?: {
    registry?: string;
    limit?: number;
}): Promise<RegistrySearchResult[]>;
/** Look up a skill by identifier (or name) across enabled skill registries. */
export declare function getSkillEntry(skillIdentifier: string, registryName?: string): Promise<SkillEntry | null>;
/** Derive a cloneable git source from a skill entry's repo/source metadata. */
export declare function skillEntryToGitSource(entry: SkillEntry): string | null;
/** Unified search across all enabled registries of the specified type(s). */
export declare function search(query: string, options?: {
    type?: RegistryType;
    registry?: string;
    limit?: number;
}): Promise<RegistrySearchResult[]>;
/** Parse a package identifier into its type (mcp, skill, git) and name. */
export declare function parsePackageIdentifier(identifier: string): {
    type: RegistryType | 'git' | 'plugin' | 'unknown';
    name: string;
};
/** Resolve a package identifier to an installable package with source metadata. */
export declare function resolvePackage(identifier: string): Promise<ResolvedPackage | null>;
/** Lowercase hex sha256 of a file's bytes. Small files only (SKILL.md). */
export declare function sha256OfFile(file: string): string;
/**
 * Parse an 'owner/repo' slug from a git remote URL (https or scp-style ssh) or
 * a filesystem-path remote whose path is slug-shaped (`…/github.com/owner/repo`).
 * Returns null if the remote is not a recognizable GitHub-style shape.
 *
 * Backslashes are folded to forward slashes first: a real git URL never
 * contains one, but a local-path remote on Windows does
 * (`C:\…\github.com\org\a.git`), and without the fold the same remote that
 * parses as `org/a` on POSIX returns null on win32 — which made the
 * projects-pull slug verification fail closed as `blocked` there (RUSH-2694).
 */
export declare function parseOwnerRepoFromRemote(remoteUrl: string): string | null;
/**
 * Walk a repo's skills/ and build a flat {@link SkillIndexDocument}. Each entry
 * carries the sha256 of its SKILL.md so install can verify integrity after
 * cloning.
 *
 * `repoSlug` is the 'owner/repo' the skills are published under, written into
 * each entry's `repo` field so {@link skillEntryToGitSource} resolves it to
 * `gh:owner/repo`. `identifier` is set to the skill's directory name so
 * `agents install skill:<name>` resolves against this index.
 */
export declare function buildSkillIndex(repoPath: string, repoSlug: string, opts?: {
    generatedAt?: string;
}): SkillIndexDocument;
/**
 * Verify a cloned skill's SKILL.md against the sha256 recorded in its registry
 * entry. Returns ok when the entry carries no sha256 — indexes published before
 * integrity hashes (or by third parties) simply skip the check. Returns an
 * error when the file is missing or its hash differs, so install can abort
 * rather than silently trusting a tampered artifact.
 */
export declare function verifySkillIntegrity(repoPath: string, entry: Pick<SkillEntry, 'name' | 'path' | 'sha256'>): {
    ok: boolean;
    error?: string;
};
