import { type Baked, type Mounted } from './launch.ts';
import { type BuildResult } from './api.ts';
import type { VerificationResult } from './manifest.ts';
export interface BootstrapOptions extends Baked {
    /** The container to verify and mount (default: `process.execPath`). */
    container?: string | undefined;
}
export type { Mounted };
/**
 * Verify the running container and mount the archive appended to it. Returns
 * where it landed; nothing has been executed out of it yet.
 */
export declare function mountSelf(options?: BootstrapOptions): Mounted;
/** Verify the running container, mount it, and run the application inside. */
export declare function bootstrap(options?: BootstrapOptions): Promise<void>;
/**
 * Verify the running container without mounting it — for an application that
 * wants to report on its own provenance ("signed by X at Y").
 */
export declare function verifySelf(options?: BootstrapOptions): VerificationResult;
/** The default flags the container runs itself with. */
export declare const SEA_EXEC_ARGV: string[];
export interface VerifierOptions {
    /**
     * Include the sigstore libraries, so the container can check a
     * sigstore-signed archive rather than degrading it to untrusted
     * (default: true). Costs roughly a megabyte of dependency tree.
     */
    sigstore?: boolean | undefined;
}
export interface SeaBaseOptions extends VerifierOptions {
    /** Where to write the base binary. */
    output: string;
    /**
     * The node binary to embed (default: the running one). This is the runtime
     * the finished container ships, so it decides which platform it runs on.
     */
    node?: string | undefined;
    /** Options baked into the stub and handed to `bootstrap()` at startup. */
    bootstrap?: BootstrapOptions | undefined;
    /** Runtime flags the container applies to itself. */
    execArgv?: string[] | undefined;
    /** A prebuilt verifier bundle to embed, instead of building one. */
    verifier?: string | undefined;
    /** Scratch directory for the generated stub and config. */
    scratch?: string | undefined;
}
export interface SeaOptions extends SeaBaseOptions {
    /** The application archive to put behind the base. Any prefix or signature it had is left behind. */
    app: string;
    /** A base built earlier, instead of building one now. */
    base?: string | undefined;
    hashAlg?: string | undefined;
    /** Progress, one line at a time. */
    log?: ((line: string) => void) | undefined;
}
export interface SeaBaseResult {
    output: string;
    size: number;
    /** Members of the verifier bundle embedded in the blob. */
    verifier: string[];
}
/**
 * Build the SEA base: a node runtime whose injected main mounts this package
 * out of its own blob and hands over to `bootstrap()`. The result is a binary
 * with no application in it yet — put one behind it with `buildSea`, or
 * with `bundle create --prefix`.
 */
export declare function createSeaBase(options: SeaBaseOptions): Promise<SeaBaseResult>;
/**
 * Build a self-validating executable, unsigned: a SEA base with `app` behind
 * it. Sign the result with `signBundle()` — the whole file, so the runtime,
 * the verifier and the application are all inside what the signature covers.
 * Until then it refuses to run. Building and signing are separate for the same
 * reason as everywhere else: what is signed is what was reviewed.
 */
export declare function buildSea(options: SeaOptions): Promise<BuildResult>;
/**
 * The files the embedded verifier needs, as paths relative to this package's
 * root. That is this package's own compiled modules plus, unless turned off,
 * the sigstore libraries — resolved through `node_modules` rather than listed,
 * so the set cannot fall behind the dependency tree.
 */
export declare function verifierFiles({ sigstore }?: VerifierOptions): string[];
/**
 * Run the built binary once, to prove that the file system inside it mounts and
 * this package can be required out of it. `--version` is the cheapest thing
 * that touches all of that, and it works whichever shape the binary is.
 */
/**
 * Where the built executable will be. Windows runs a file because of its
 * extension, so a SEA without `.exe` is a file nothing will start — including
 * the self-test below, which would report a build failure for what is really a
 * naming one. Everywhere else the name is left exactly as asked for.
 */
export declare function executablePath(output: string): string;
/**
 * An executable built here, by the name it was built under. On Windows that
 * name gained `.exe` (see `executablePath()`), so `--output node-verifying`
 * followed by `--base node-verifying` would otherwise not find what it built.
 */
export declare function existingExecutable(path: string): string;
/**
 * The preload every thread of the executable runs before anything else.
 *
 * The main thread has nothing to do here: the SEA main script verifies and
 * mounts the application. A worker thread starts with nothing mounted at all —
 * not even the file system node gives the main thread — so this mounts that
 * file system itself, from the archive embedded in the executable (which
 * `node:sea` hands any thread), requires the launcher out of it, and has it
 * set the worker up as the main thread is: see `worker()` in launch.ts. It
 * mounts first, so the application lands at the path the main thread has it.
 */
export declare function workerPreloadSource(options: BootstrapOptions): string;
/**
 * The CommonJS stub injected as the SEA's main script. It runs at the root of
 * the mounted verifier bundle, so requiring this package is a relative path and
 * nothing more; everything else it needs to decide, `launch` decides by looking
 * at the binary's own tail.
 *
 * It stays the one piece no test can exercise from source, so it stays small.
 */
export declare function stubSource(options: BootstrapOptions): string;
//# sourceMappingURL=sea.d.ts.map