/** Bounded external CLI observation for the existing installed-artifact verifier. @packageDocumentation */
import type { CertifiableProviderCli, ProviderVerificationInvocation, ProviderVerificationProcessResult } from '@cleocode/contracts/capabilities';
/**
 * Return normal noninteractive CLI flags without adapter bypass defaults.
 * @param provider - External CLI, distinct from its programmatic adapter.
 * @returns Fixed argument prefix; the scenario prompt is appended separately.
 * @example
 * ```ts
 * const args = providerVerificationArguments('codex');
 * ```
 */
export declare function providerVerificationArguments(provider: CertifiableProviderCli): readonly string[];
/**
 * Observe a real external provider using canonical spawning and bounded cleanup.
 * @param input - Captured isolated invocation; no ambient environment is inherited.
 * @returns Process evidence only; repair, instruction delivery and lifecycle remain unverified.
 * @remarks Process groups cannot prove that descendants did not escape. A successful
 * systemd launch or kill request is not an independently verified empty cgroup.
 * @example
 * ```ts
 * const processEvidence = await runProviderVerification(invocation);
 * // Independently inspect actual installed repair receipts before assessing capabilities.
 * ```
 */
export declare function runProviderVerification(input: ProviderVerificationInvocation): Promise<ProviderVerificationProcessResult>;
//# sourceMappingURL=provider-verification.d.ts.map