/**
 * On-demand download + verification of the macOS `agents computer` helper
 * ("ComputerHelper.app").
 *
 * The helper is a signed + notarized universal `.app` bundle published as a
 * GitHub release asset on its own `computer-mac/v<x.y.z>` tag (see
 * `helper-versions.ts`). The Windows helper (`lib/computer/ssh-tunnel.ts`) does
 * NOT yet follow this model — it still keys its exe to the CLI's own tag.
 *
 * A fresh `npm i -g` machine has no local build, so `agents computer setup` / `agents setup computer` fetch the
 * asset for the pinned helper version, verify its sha256 against the published
 * `.sha256`, then verify the code signature (Developer ID Team + notarization)
 * before it is ever copied to /Applications.
 *
 * The download + verify machinery is shared with the menu-bar helper in
 * `../helper-download.ts`; this file is the ComputerHelper spec + its wrappers,
 * keeping the historical export surface (`verifyMacHelper`, `downloadMacHelperApp`,
 * `ensureMacHelperApp`, …) stable for existing callers. ComputerHelper does NOT
 * pin a designated requirement (no `expectedBundleId`), matching its verification
 * strength before the shared primitive existed.
 */
import { EXPECTED_TEAM_ID, HELPER_RELEASE_REPO, parseTeamId } from '../helper-download.js';
export { EXPECTED_TEAM_ID, HELPER_RELEASE_REPO, parseTeamId };
/** The zipped `.app` release asset name. */
export declare const MAC_HELPER_ASSET = "ComputerHelper.app.zip";
/** The bundle directory name once extracted. */
export declare const MAC_HELPER_APP_NAME = "ComputerHelper.app";
/** Cache dir for the downloaded helper, one subdir per release tag. */
export declare function macHelperCacheDir(version: string): string;
/** Release-asset URLs for the helper zip + its checksum at one `v<version>` tag. */
export declare function macHelperAssetUrls(version: string): {
    zip: string;
    sha256: string;
};
/**
 * Verify a helper `.app` bundle is intact, signed by the expected Developer ID
 * Team, and notarized (Gatekeeper-accepted). Throws with an actionable message
 * on any failure — a downloaded bundle is never trusted without this.
 */
export declare function verifyMacHelper(appPath: string): void;
/**
 * Download the helper release asset for `version`, verify sha256, extract the
 * `.app`, and verify its signature. Returns the path to the extracted
 * `ComputerHelper.app`. A missing asset is a hard error naming the exact tag —
 * never a silent fallback to another release.
 */
export declare function downloadMacHelperApp(version: string): Promise<string>;
/**
 * Resolve the helper `.app` to install from: a local build / bundled copy first
 * (repo checkout), else the checksum + signature-verified release-asset download
 * for the pinned helper version. Throws with the tag it checked when neither
 * exists. macOS only.
 */
export declare function ensureMacHelperApp(version?: string): Promise<string>;
