export declare const PINNED_LAUNCHER_SCHEMA = "hasna-skills-pinned-launcher-v3";
/** The variable the launcher uses to hand the caller's directory to the CLI. */
export declare const LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
/** Bun runtime flags that remove every working-directory configuration source. */
export declare const PINNED_LAUNCHER_BUN_FLAGS: readonly ["--config=/dev/null", "--no-env-file", "--no-macros", "--no-install"];
/** V3 also preserves Claude's explicit native configuration root. */
export declare const PINNED_LAUNCHER_ENV_NAMES: readonly ["HOME", "PATH", "TMPDIR", "TERM", "TERM_PROGRAM", "TERM_PROGRAM_VERSION", "COLORTERM", "LANG", "USER", "LOGNAME", "SHELL", "TZ", "NO_COLOR", "FORCE_COLOR", "CI", "COLUMNS", "LINES", "EDITOR", "VISUAL", "PAGER", "SSH_AUTH_SOCK", "TERMINAL_CWD", "CODEX_HOME", "HERMES_HOME", "HERMES_ENABLE_PROJECT_PLUGINS", "HOST", "PORT", "NODE_ENV", "AGENT_ID", "ECS_CONTAINER_METADATA_URI_V4", "CLAUDE_CONFIG_DIR"];
/** Environment name prefixes passed through, for the app's own documented overrides. */
export declare const PINNED_LAUNCHER_ENV_PREFIXES: readonly ["HASNA", "SKILLS", "SKILL", "MCP", "XDG", "LC", "AWS"];
/** The allowlisted subset of an environment, by the same rule the launcher applies. */
export declare function pinnedLauncherEnvironment(env: Record<string, string | undefined>, profile?: LauncherProfile): Record<string, string>;
export type LauncherShape = "symlink" | "pinned";
export type LauncherFormat = "v1" | "v2" | "v3";
export type LauncherProfile = "client" | "server";
export interface LauncherMetadata {
    format?: LauncherFormat;
    profile?: LauncherProfile;
}
export interface PinnedLauncherBinding extends LauncherMetadata {
    runtime: string;
    cwd: string;
    entry: string;
}
/** Role follows the package's public bin/entry contract, never a path substring. */
export declare function launcherProfileForBin(name: string, entry: string): LauncherProfile;
export type LauncherState = {
    shape: "symlink";
    linkTarget: string;
    target: string;
} | ({
    shape: "pinned";
    runtime: string;
    cwd: string;
    target: string;
    sha256: string;
} & LauncherMetadata);
export type InspectedLauncher = {
    kind: "symlink";
    linkTarget: string;
    target: string;
} | ({
    kind: "pinned";
    runtime: string;
    cwd: string;
    target: string;
    sha256: string;
    text: string;
} & LauncherMetadata) | {
    kind: "foreign";
};
/** The exact launcher text for one Bun binary, trusted directory and entry. Deterministic. */
export declare function renderPinnedLauncher(binding: PinnedLauncherBinding): string;
/** Parse launcher text; only the exact rendered shape is accepted. */
export declare function parsePinnedLauncher(text: string): PinnedLauncherBinding | null;
/**
 * Resolve a command path the way the symlink checks used to: the physical file
 * it reaches and, when that file is a managed pinned launcher (its exact
 * rendered text), the entry the launcher runs. `entry` equals `physical` for a
 * symlink or a plain executable. A pinned entry must itself be a physical path.
 */
export declare function resolveLauncherCommand(path: string): {
    physical: string;
    entry: string;
    pinned: (PinnedLauncherBinding & {
        sha256: string;
    }) | null;
};
/** Classify the launcher at `path` without following anything but its own symlink. */
export declare function inspectLauncher(path: string): InspectedLauncher;
/** The entry a managed launcher runs, whichever shape it has. */
export declare function launcherTarget(path: string): string;
/** The "link text" of a managed launcher: the symlink text, or the pinned entry path. */
export declare function launcherLinkText(path: string): string;
/** Whether the launcher at `path` is exactly `state`: same shape, text and target. */
export declare function launcherIs(path: string, state: LauncherState): boolean;
/** The pinned launcher text for a state, verified against the recorded digest. */
export declare function pinnedLauncherText(state: {
    runtime: string;
    cwd: string;
    target: string;
    sha256: string;
} & LauncherMetadata): string;
/** Build the pinned state for an entry under the given Bun binary and trusted directory. */
export declare function pinnedLauncherState(runtime: string, cwd: string, target: string, metadata?: LauncherMetadata): Extract<LauncherState, {
    shape: "pinned";
}>;
/**
 * Create a launcher in `state` at a path that must not exist yet, and read it
 * back. Symlinks are created as-is; pinned launchers are regular 0755 files.
 */
export declare function materializeLauncher(path: string, state: LauncherState): void;
/**
 * The Bun binary launchers are pinned to: the exact runtime running the
 * updater, resolved physically and required to be owned by root or the
 * current user, executable, and not writable by group or others.
 */
export declare function pinnedLauncherRuntime(): string;
/** A pinned runtime is a physical, executable regular file owned by root or the current user and not group/world-writable. */
export declare function assertPinnedLauncherRuntimeSafe(runtime: string): void;
/**
 * The launcher depends on `/bin/sh -p`, `/usr/bin/awk` and `/usr/bin/env`.
 * Refuse before any launcher is written when this station's shell rejects
 * `-p` (for example dash before 0.5.11), so no launcher is left unusable.
 */
export declare function assertPinnedLauncherShell(): void;