import { type ContainerProcessIdentity } from './containerRelayLifecycle.js';
export declare function matchingCliExecutable(pid: number, caller: string, uid: number): Promise<boolean>;
interface ProcessVerification {
    uid?: number;
    execPath?: string;
    identity?(pid: number): Promise<ContainerProcessIdentity>;
    resolve?(path: string): Promise<string>;
    executableMatches?(pid: number, caller: string, uid: number): Promise<boolean>;
    verifyRuntime?(candidate: string, caller: string): Promise<string>;
}
/** Normalize npm aliases only after verifying the live executable and exact
 * published CLI bytes. Callers still enforce their complete action/flag tuple. */
export declare function verifiedCliProcessArguments(identity: ContainerProcessIdentity, callerIndex: string, runtime?: ProcessVerification): Promise<string[] | null>;
export {};
//# sourceMappingURL=cliProcessIdentity.d.ts.map