import type { ArtifactBundle } from "../io/artifacts.js";
import type { ExecutorRunResult } from "./executorResult.js";
import type { AnalyzerSetting, AnalyzerConsentTokenGrant } from "audit-tools/shared";
import type { BinaryFetcher, BinaryCommandRunner } from "audit-tools/shared";
/**
 * Advance-level options for the external-analyzer acquisition executor.
 *
 * The HERMETICITY GATE is `enabled`: the executor is a NO-OP that writes an empty
 * marker UNLESS `enabled === true`. The unit/integration suite never sets it, so
 * no subprocess or network ever runs in tests; only the real CLI next-step path
 * enables acquisition (and supplies the global-`fetch` adapter). `fetch`/`run` are
 * injectable so an enabled-path test can drive the engine without touching the
 * network or spawning a real process.
 */
export interface ExternalAcquisitionAdvanceOptions {
    /** Hermeticity gate: acquisition runs ONLY when true. Default off (empty marker). */
    enabled?: boolean;
    /** Injected network fetch for binary acquisition; defaults to a global-fetch adapter. */
    fetch?: BinaryFetcher;
    /** Injected command runner (probe / spawn); defaults to the shared runTrackedAsync. */
    run?: BinaryCommandRunner;
    /**
     * Per-run, tool-SCOPED consent grant gating non-default candidates (semgrep /
     * eslint / …). Typed as {@link AnalyzerConsentTokenGrant} — never a bare string —
     * so a grant admits ONLY the candidates it names and an operator's recorded
     * decline is overridden by nothing.
     */
    consentToken?: AnalyzerConsentTokenGrant;
    /** Per-analyzer resolution policy (auto|ephemeral|permanent|skip|repo). */
    analyzers?: Record<string, AnalyzerSetting>;
    /**
     * Item B: recorded consent decisions from session config. A recorded
     * "granted" admits a non-default candidate without a per-run grant; a
     * recorded "declined" is terminal — no grant overrides it.
     */
    analyzerConsent?: Record<string, "granted" | "declined">;
    /** Override the binary cache dir / platform / arch (tests). */
    cacheDir?: string;
    platform?: NodeJS.Platform;
    arch?: string;
}
/**
 * Slice D — production wiring of the external-analyzer acquisition engine.
 *
 * Resolves (PATH → cache → checksum-verified download) every `binary` candidate,
 * runs the whole registered candidate set through the engine, and upserts each
 * tool's normalized findings into `external_analyzer_results`. Writes the
 * provenance/staleness marker `external_analyzer_acquisition.json` either way.
 *
 * Never throws: the engine degrades every candidate to a status record, and the
 * disabled path is a pure marker write. `external_analyzer_results.json` is listed
 * in `artifacts_written` only when a tool actually contributed findings, so an
 * unchanged results array never churns its downstreams.
 */
export declare function runExternalAnalyzerAcquisitionExecutor(bundle: ArtifactBundle, root: string | undefined, options?: ExternalAcquisitionAdvanceOptions): Promise<ExecutorRunResult>;
//# sourceMappingURL=acquisitionExecutor.d.ts.map