/**
 * @file Integrity specification helpers for downloads and file verification.
 *   Used by `dlx/binary-download` and external-tools resolvers; safe to consume
 *   from any module that needs to verify bytes against an expected hash. Single
 *   supported format per flavor:
 *
 *   - integrity: SRI with sha512 only (what npm registry returns)
 *   - checksum: sha256 hex (what `shasum -a 256` produces; common for binary
 *     release assets on GitHub) Callers may pass a {@link HashSpec} as a bare
 *     string (sniffed via format) or as an explicit `{ type, value }` object.
 *     The normalized form carried around internally is always the object.
 */
/**
 * Tagged union representing an expected hash.
 *
 * @example
 *   // Bare SRI (sniffed as integrity):
 *   'sha512-abc...'
 *
 * @example
 *   // Bare sha256 hex (sniffed as checksum):
 *   'a1b2c3...'
 *
 * @example
 *   // Explicit:
 *   { type: 'integrity', value: 'sha512-abc...' }
 *   { type: 'checksum', value: 'a1b2c3...' }
 */
export type HashSpec = string | {
    type: 'integrity';
    value: string;
} | {
    type: 'checksum';
    value: string;
};
/**
 * Normalized internal form. Always an object.
 */
export interface NormalizedHash {
    type: 'integrity' | 'checksum';
    value: string;
}
/**
 * Both hash formats for the same bytes. Returned from downloads so callers can
 * record whichever format their config uses.
 */
export interface ComputedHashes {
    /**
     * SRI integrity: `sha512-<base64>`. Matches what the npm registry returns.
     */
    integrity: string;
    /**
     * SHA-256 hex (64 chars). Matches `shasum -a 256`.
     */
    checksum: string;
}
/**
 * Compute both integrity (sha512 SRI) and checksum (sha256 hex) for a buffer of
 * bytes.
 */
export declare function computeHashes(bytes: Buffer): ComputedHashes;
export declare function isChecksumString(s: string): boolean;
export declare function isIntegrityString(s: string): boolean;
/**
 * Normalize a {@link HashSpec} to its canonical `{ type, value }` form.
 *
 * - Object form is trusted (its `value` is validated for shape).
 * - Bare string matching sha512 SRI → integrity.
 * - Bare string of 64 hex chars → checksum.
 * - Anything else throws TypeError.
 *
 * @throws TypeError if the string is not a recognized format, or if an explicit
 *   object's value doesn't match its declared type.
 */
export declare function normalizeHash(spec: HashSpec): NormalizedHash;
/**
 * Verify computed hashes against an expected {@link NormalizedHash}. Uses
 * `crypto.timingSafeEqual` for constant-time comparison.
 *
 * @throws DlxHashMismatchError when the hash of the matching type doesn't match
 *   the expected value.
 */
export declare function verifyHash(expected: NormalizedHash, computed: ComputedHashes): void;
/**
 * Thrown when an expected hash doesn't match the computed hash of the
 * downloaded bytes. Carries both sides for diagnostics.
 */
export declare class DlxHashMismatchError extends Error {
    readonly expected: NormalizedHash;
    readonly actual: ComputedHashes;
    constructor(expected: NormalizedHash, actual: ComputedHashes);
}
