/**
 * @file Reader for `external-tools.json` — the fleet manifest describing
 *   downloadable external binaries (sfw, zizmor, etc.) with pinned versions,
 *   per-platform asset names, and integrity hashes. The manifest itself is
 *   hand-maintained in each fleet repo's root (`<repo>/external-tools.json`)
 *   and consumed by the setup-and-install GitHub action. This reader gives
 *   in-process consumers (external- tools resolvers, ad-hoc scripts) the same
 *   typed view without each one re-implementing the JSON-parse + shape check +
 *   integrity-string validation. Shape: { "<tool-name>": { "description":
 *   "human-readable summary", "version": "1.7.2", "release": "asset" |
 *   "tarball" | ..., "repository": "github:owner/repo", "notes": [...],
 *   "checksums": { "<platform-arch>": { "asset": "<asset-filename>",
 *   "integrity": "sha256-base64=" } } } } Some tools have flavor variants (e.g.
 *   sfw's `free` / `enterprise`) that wrap the `{repository, binaryName,
 *   checksums}` triple under a flavor key. Use `getToolFlavor` for those. Some
 *   entries (e.g. `rust`) describe a system tool with a different shape —
 *   they're skipped by `getTool` and fully readable only via the raw
 *   `readManifest` returning unknown.
 */
/**
 * Lookup helper — return the plain tool entry for `toolName`, or `undefined` if
 * the manifest doesn't have it or the entry is flavored / other-shape.
 */
export declare function getTool(manifest: Manifest, toolName: string): ToolEntry | undefined;
/**
 * Lookup helper — return the specific flavor of a flavored tool, or `undefined`
 * if the tool isn't flavored or the flavor doesn't exist.
 */
export declare function getToolFlavor(manifest: Manifest, toolName: string, flavor: string): ToolFlavor | undefined;
/**
 * Per-platform asset record: which filename to fetch from the release, plus the
 * integrity hash to verify against.
 */
export interface ToolChecksum {
    /**
     * Asset filename on the GitHub release page.
     */
    asset: string;
    /**
     * SRI integrity string, e.g. `sha256-<base64>=`. Validated on read.
     */
    integrity: string;
}
/**
 * A downloadable-binary tool entry. `checksums` is keyed by the fleet's
 * platform-arch token (`darwin-arm64`, `linux-x64-musl`, `win-x64`, etc. — same
 * vocabulary as `getPlatformArch`).
 */
export interface ToolEntry {
    description: string;
    version: string;
    release: string;
    repository: string;
    binaryName?: string | undefined;
    notes?: readonly string[] | undefined;
    checksums: Readonly<Record<string, ToolChecksum>>;
}
/**
 * A flavored tool entry — sfw is the canonical example, with `free` and
 * `enterprise` variants sharing the same outer `description` / `version` /
 * `release` but each carrying its own `{repository, binaryName, checksums}`.
 */
export interface FlavoredToolEntry {
    description: string;
    version: string;
    release: string;
    notes?: readonly string[] | undefined;
    flavors: Readonly<Record<string, ToolFlavor>>;
}
export interface ToolFlavor {
    repository: string;
    binaryName?: string | undefined;
    checksums: Readonly<Record<string, ToolChecksum>>;
}
/**
 * Parsed manifest. `tools` is a flat map; the values are unions because some
 * tools are plain (`ToolEntry`) and some are flavored (`FlavoredToolEntry`).
 * Unknown shapes (rust's `components` entry, future variants) come back as `{
 * kind: 'other'; raw: unknown }` so callers can opt in to handle them.
 */
export interface Manifest {
    tools: Readonly<Record<string, ManifestEntry>>;
}
export type ManifestEntry = {
    kind: 'tool';
    entry: ToolEntry;
} | {
    kind: 'flavored';
    entry: FlavoredToolEntry;
} | {
    kind: 'other';
    raw: unknown;
};
export declare function isObject(value: unknown): value is Record<string, unknown>;
export declare function parseChecksum(raw: unknown, toolName: string, platformKey: string): ToolChecksum;
export declare function parseChecksums(raw: unknown, toolName: string): Record<string, ToolChecksum>;
export declare function parseToolEntry(raw: unknown, toolName: string): ManifestEntry;
/**
 * Read an `external-tools.json` file from disk and return the parsed manifest.
 * Throws on malformed JSON or invalid integrity strings; unknown-shape entries
 * (rust components, future variants) come back as `{kind: 'other', raw}` so
 * callers can handle them out-of-band without blocking the manifest read.
 */
export declare function readExternalToolsManifest(filepath: string): Promise<Manifest>;
export declare function tryParseFlavored(raw: Record<string, unknown>, toolName: string): FlavoredToolEntry | undefined;
