/** Machine-global host dir. Deliberately NOT under `CRTR_HOME` (tests override
 *  that to an isolated temp): the branded binary is a per-machine artifact keyed
 *  to the installed node, shared across every canvas home. */
export declare function brandedHostDir(): string;
export declare function brandedHostBin(): string;
/** macOS keys FDA grants on the Mach-O cdhash. A real developer identity
 *  keeps that hash stable across branded-host rebuilds; ad-hoc signing is the
 *  portable default for machines without a local signing certificate. */
export declare function codesignIdentitiesForBrandedHost(opts?: {
    configured?: string | null;
    discovered?: string | null;
}): string[];
export declare function signBrandedHostArtifacts(binPath: string, libnodePath: string | null, sign?: (path: string) => void): void;
export declare function brandedHostWorks(binPath: string, timeoutMs?: number): boolean;
/** Ensure the branded host binary exists and matches the live node; return its
 *  absolute path. Idempotent and self-healing. Throws on a genuine build failure
 *  (disk full / permissions) — branding is load-bearing for FDA, so a failure is
 *  surfaced, never silently masked by falling back to `node`. */
export declare function ensureBrandedHost(): string;
/** The path the engine (broker / daemon) should be launched from. On macOS in a
 * compiled (production) build this is the validated branded host; otherwise —
 * non-darwin (TCC is macOS-only), source/tsx (dev + the test suite: never copy
 * 70 MB into the real ~/.crouter), or the explicit `CRTR_BRANDED_HOST=0`
 * opt-out — it is the live node. */
export declare function hostExecPath(): string;