/**
 * The identity of the executable that starts the Jensen evaluation candidate.
 * The launcher is authorized by *identity* (a validated absolute path to the
 * verified runtime executable), never by its display basename. Renaming the
 * binary must not change its identity, and an unrelated executable that merely
 * shares the basename must not inherit launcher authority.
 */
export type LauncherId = "jensen_source_runtime" | "jensen_compiled_runtime" | "external_explicit";
export type LauncherSource = "current_process" | "configured" | "fixture";
export interface RuntimeExecutableIdentity {
    runtimeKind: "node_source" | "bun_compiled" | "native_packaged" | "configured_external";
    requestedPath: string;
    resolvedPath: string;
    realPath?: string;
    basename: string;
    platform: string;
    fileIdentity?: string;
    contentHash?: string;
    trustedOrigin: LauncherSource;
    launcherId: LauncherId;
}
export interface EvaluationCandidateLauncher {
    launcherId: LauncherId;
    executablePath: string;
    executableIdentity: string;
    invocationPrefix: string[];
    source: LauncherSource;
    trustedByRuntime: boolean;
}
/**
 * A logical capability mapped to a resolved executable identity. The mapping
 * separates a capability name (for example "node") from the actual resolved
 * executable path, so a capability never confers trust on every executable
 * whose basename happens to match.
 */
export interface AuthorizedExecutable {
    capabilityId: string;
    resolvedPath: string;
    allowedArguments?: string[];
    effectClass: string;
    source: string;
}
export interface ResolvedExecutable {
    requestedPath: string;
    resolvedPath: string;
    realPath?: string;
    basename: string;
    exists: boolean;
    executable: boolean;
    resolutionError?: string;
}
export declare const JENSEN_CANDIDATE_MARKER = ".jensen-candidate-complete";
export declare const SANDBOX_SELF_PROBE: readonly ["eval", "self-probe", "--json"];
/** Case-insensitive path comparison on Windows, case-sensitive elsewhere. */
export declare function samePath(left: string, right: string): boolean;
/**
 * Resolve the identity of a command/executable path. Relative commands are
 * resolved against the provided working directory. realpath is applied to
 * follow symlinks where the target exists.
 */
export declare function resolveExecutable(command: string, cwd: string): Promise<ResolvedExecutable>;
/** Determine the current runtime kind from the running environment. */
export declare function detectCurrentRuntimeKind(): {
    runtimeKind: RuntimeExecutableIdentity["runtimeKind"];
    executablePath: string;
    basename: string;
};
export interface ResolveLauncherOptions {
    cwd?: string;
    /** Configured external launcher; only honored when explicitly provided. */
    configuredExternal?: {
        executablePath: string;
        invocationPrefix: string[];
        source: LauncherSource;
    };
    /** Enable the current-process launcher (default true). */
    useCurrentProcess?: boolean;
}
/**
 * Resolve the trusted candidate launcher. The current-process launcher is
 * derived from the verified running executable. An external launcher is only
 * used when explicitly configured with an absolute path.
 */
export declare function resolveCandidateLauncher(options?: ResolveLauncherOptions): Promise<EvaluationCandidateLauncher>;
export declare function createRuntimeExecutableIdentity(options?: ResolveLauncherOptions): Promise<RuntimeExecutableIdentity>;
//# sourceMappingURL=launcher.d.ts.map