import * as VFS from 'node:vfs';
import { type VerificationResult } from './manifest.ts';
/** What a caller can decide about a container before it is allowed to run. */
export interface LaunchOptions {
    /** Extra trusted roots, as PEM text or paths to PEM files. */
    roots?: string[] | undefined;
    /** Require this sigstore signing identity. */
    identity?: string | undefined;
    /** Require this sigstore OIDC issuer. */
    issuer?: string | undefined;
    /** Path to the sigstore trust root to check against. */
    trustedRoot?: string | undefined;
    /** Require attestations from these attesters, as `[kind@]did`. */
    attesters?: string[] | undefined;
    /** How many of `attesters` must have attested (default: all of them). */
    quorum?: number | undefined;
    /** Milliseconds a cached attestation proof stays good for (default: seven days). */
    maxAge?: number | undefined;
    /** Refuse a container any of these DIDs has marked bad. */
    block?: string[] | undefined;
    /**
     * Run a container whose signature is good but whose chain is not anchored
     * in the trust store (default: false).
     */
    allowUntrusted?: boolean | undefined;
    /**
     * Recompute every member digest at mount rather than on first read
     * (default: false — reads check them anyway, and this is startup latency).
     */
    deep?: boolean | undefined;
    /** Entry point inside the archive, overriding its package.json `main`. */
    entry?: string | undefined;
    /**
     * What to do when the container does not verify. The default prints the
     * reason and exits 1; nothing from the archive has run at that point.
     */
    onRefuse?: ((reason: string) => void) | undefined;
}
/** Where a mounted container ended up, and what it is. */
export interface Mounted {
    /** The generated mount point the archive is visible at. */
    root: string;
    /** The mount, so a caller can unmount it. */
    vfs: VFS.VirtualFileSystem;
    /** The resolved entry point, as an absolute path under `root`. */
    entry: string;
}
/**
 * Verify `container` and mount it. Returns where it landed; nothing has been
 * executed out of it yet.
 */
export declare function mount(container: string, options?: LaunchOptions): Mounted;
/**
 * Run what is at a mount's entry point. A CommonJS entry is `require()`d and an
 * ES module is `import()`ed, chosen the way node itself chooses — the archive's
 * `package.json` `type` and the entry's own extension.
 */
export declare function start({ root, entry }: Mounted): Promise<void>;
/** Where a SEA's main thread records what it mounted, for its workers. */
export declare const THREAD_ENV = "BUNDLE_SEA_THREAD";
/**
 * Set up a worker thread of a SEA as its main thread is: the same container,
 * verified again under the same policy, mounted at the same path — so the
 * worker's script, a path into it, resolves — with plugins verified as they
 * are there.
 *
 * What the main thread mounted comes from the environment, which the
 * application itself can change, so it is not taken on trust. A container
 * with an application appended runs only that application, whatever the
 * record says; and a sealed runtime's own policy holds over the recorded one,
 * as it does over a command line.
 */
export declare function worker(baked?: Baked): Mounted;
/** Verify a container, mount it, and run the application inside. */
export declare function run(container: string, options?: LaunchOptions): Promise<void>;
/**
 * Verify the running executable and run the archive appended to it — the
 * self-validating shape, where the signature covers the runtime, the verifier
 * and the application as one file.
 */
export declare function runSelf(options?: LaunchOptions): Promise<void>;
/** Verify a container without mounting or running it. */
export declare function verify(container: string, options?: LaunchOptions): VerificationResult;
/**
 * What, if anything, is appended to a container.
 *
 * This is how one binary can be both shapes: an executable with a signed
 * archive behind it runs *that*, and the same executable with nothing appended
 * takes an archive from its command line instead. The discriminator is the
 * signature marker rather than the presence of a ZIP, because a SEA carries an
 * archive of its own inside its blob — one that is not at the tail, and never
 * carries a marker.
 */
export declare function appended(container: string): 'signed' | 'unsigned' | 'none';
/**
 * The command line of a verifying node.
 *
 * Options are read up to the first non-option argument, which is the archive;
 * everything after it belongs to the application, untouched. That is the shape
 * of every command that wraps another one — `env`, `nice`, `time` — and it is
 * what lets an application have flags of its own that collide with these.
 */
export declare const USAGE = "usage: <runtime> [options] <archive> [args...]\n\nVerifies an archive and runs the application inside it. Nothing from the archive\nruns until its signature, its certificate chain and its member digests check out,\nand every member is re-hashed as it is read for the life of the process.\n\noptions:\n  -r, --root <file>     extra trusted root certificate (PEM); repeatable\n      --identity <san>  require this sigstore signing identity\n      --issuer <url>    require this sigstore OIDC issuer\n      --attester <[kind@]did>  require an attestation from this DID; repeatable.\n                        Checked against the cache 'bundle trust' fills\n      --quorum <n>      how many of the attesters must have attested (default: all)\n      --max-age <time>  how stale a cached attestation may be (default: 7d)\n      --block <did>     refuse an archive this DID has marked bad; repeatable\n      --untrusted       run an archive whose signature is good but unanchored\n      --deep            check every member digest at mount, not on first read\n      --entry <path>    entry point inside the archive, overriding its main\n      --verify          report the archive's trust state and stop\n  -h, --help            this\n      --version         the verifier's version, and the runtime's\n\nThe same policy can come from the environment \u2014 BUNDLE_ROOTS, BUNDLE_IDENTITY,\nBUNDLE_ISSUER, BUNDLE_SIGSTORE_ROOT, BUNDLE_ATTESTERS, BUNDLE_QUORUM,\nBUNDLE_ATTESTATION_MAX_AGE, BUNDLE_BLOCK, BUNDLE_ALLOW_UNTRUSTED \u2014 which is what a container\nbuilt with no policy of its own falls back to.\n";
/** Options baked into a runtime at build time, and whether they are the last word. */
export interface Baked extends LaunchOptions {
    /**
     * A runtime built with a policy of its own accepts no policy from its
     * command line: a binary that demands a signing identity is not one whose
     * user can ask it to stop. Adding a root, requiring a different identity,
     * naming attesters and `--untrusted` are all refused. What remains —
     * `--entry`, `--verify`,
     * `--help` — cannot loosen anything.
     */
    sealed?: boolean | undefined;
}
/**
 * Run a verifying node's command line. Returns the exit code; the application's
 * own exit code is its business, set the ordinary way from inside it.
 */
export declare function main(argv: string[], baked?: Baked): Promise<number>;
//# sourceMappingURL=launch.d.ts.map