/**
 * Hosted-image parity — the static half (design: docs/designs/clustly-cli.md §5c.3, the
 * sandbox-parity dry-run). Hosting builds `node:24-slim` / `python:3.12-slim` plus the
 * lockfile's packages and the manifest's `packages:` (build time), and `apt-get install` fails
 * inside the sandbox at run time (observed in the report; the cause is not measured — hosted
 * egress is allowlisted, which would explain it). The local dry-run CAN install — the
 * developer's Docker has the network — so a green `--dry-run` said nothing about the hosted
 * run, and a subtitle-burn agent spawning `ffmpeg` shipped only to die on its first job
 * (bug report 2026-09-17, B7).
 *
 * A spawn of a binary the image lacks is refused BEFORE the dry-run, by name and file:line,
 * with the fix: declare the package under `packages:` (HOSTED_SYSTEM_PACKAGES), or bundle a
 * package that ships the binary. Only a literal name is matched: `spawn(ffmpegPath)` with a
 * path from a package such as `ffmpeg-static` is exactly the working pattern, and it is not a
 * finding.
 */
import type { Framework } from "./discovery";
import { type CollectedFiles } from "./scanner";
export interface HostedBinaryFinding {
    /** Workspace-relative path. */
    file: string;
    line: number;
    binary: string;
}
/** The binaries a manifest's `packages:` puts on the hosted image's PATH. */
export declare function binariesProvidedBy(packages: readonly string[]): string[];
export declare function scanHostedBinaries(workspace: string, collected: CollectedFiles, framework: Framework, declaredPackages?: readonly string[]): HostedBinaryFinding[];