/**
 * Immutable facts about the exact bytes at an executable path — the SINGLE
 * producer of executable facts shared by the harness PATH resolver and the
 * setup-login evidence gate, so the two surfaces can never disagree about the
 * same file (the parity break that made setup-login reject a binary Doctor and
 * runs accepted).
 *
 * `nlink` is captured as a FACT, never an inline rejection here: link-count
 * policy is scoped to the file's owner/type by the CALLER. Daemon-owned MUTABLE
 * files (journal, token, locks) legitimately require `nlink === 1` at their own
 * call-sites — a second hard link there means the private file is not
 * exclusively owned. An external, read-only vendor binary is a different case:
 * the official installer hard-links the platform binary into its launcher
 * (`@anthropic-ai/claude-code` → `nlink === 2`), so for a binary Claudexor never
 * writes, `dev`/`inode`/`sha256` already prove which exact bytes will run and
 * the link count is irrelevant.
 */
export interface ExecutableInspection {
    /** realpath-resolved canonical path (all symlinks followed). */
    realpath: string;
    isRegularFile: boolean;
    /** Any exec bit set (POSIX mode & 0o111). Advisory on win32. */
    isExecutable: boolean;
    size: number;
    /** mode & 0o7777. */
    mode: number;
    device: string;
    inode: string;
    nlink: number;
    /** The opened inode still matches the named canonical file and it is not a
     *  symlink — no swap raced between open and stat. */
    identityStable: boolean;
}
/**
 * Safely open the realpath-resolved canonical file (O_NOFOLLOW so a swapped
 * symlink can't redirect us; O_NONBLOCK so a FIFO on PATH cannot block the
 * open), capture its facts, and hand the SAME fd to `fn` so a content read is
 * byte-faithful to the exact inode we identity-checked (no TOCTOU between the
 * check and the read).
 */
export declare function withExecutableInspection<T>(path: string, fn: (info: ExecutableInspection, fd: number) => T): T;
/** Facts only (fd closed before returning). */
export declare function inspectExecutable(path: string): ExecutableInspection;
/** True when the inspection describes a real, bounded regular file. */
export declare function isBoundedRegularExecutable(info: ExecutableInspection): boolean;
/**
 * Cheap "the process can spawn this" verdict for the harness PATH resolver: a
 * bounded regular file the current user may execute. No content hash. Returns
 * false on any inspection error (dangling symlink, permission, mid-walk race).
 */
export declare function isLaunchableExecutable(path: string, platform?: NodeJS.Platform): boolean;
//# sourceMappingURL=executable-inspection.d.ts.map