/**
 * (crew#1068) The wicked-vault CLI the engine records held team findings with.
 *
 * wicked-core vaults a team finding held for the operator (core#959 / core#1006) by running the
 * wicked-vault CLI named by `WICKED_VAULT_BIN`, read per record (`src/team/vault.rs`; empty = the
 * vault is switched off). Crew ships `wicked-vault` as a runtime dependency and, before the engine
 * spawns, exports the absolute path of that package's own `wicked-vault` bin as the variable, so a
 * held finding always gets a vault entry instead of reading "not vaulted". ONE mechanism: PATH is
 * never touched, and nothing else is tried.
 *
 * An operator's own `WICKED_VAULT_BIN` (the value this process booted with) is kept exactly — an
 * explicit empty value included, because that is the vault switched off on purpose. When crew's own
 * bin cannot be resolved, or the operator switched the vault off, the daemon still boots: the
 * posture rides `/health.warnings` (and `wicked-crew status`) and `/diagnostics.vault` with a remedy.
 */
import type { DiagnosticsVault, HealthWarning } from 'wicked-crew-api-types';
export declare const VAULT_BIN_ENV = "WICKED_VAULT_BIN";
/** The value this process BOOTED with: an operator's choice, never one crew exported itself. */
export declare const BOOT_VAULT_BIN: string | undefined;
/** What the engine is handed: crew's shipped bin, the operator's value, the vault switched off by
 *  the operator, or nothing because crew's bin could not be resolved (`reason` says why). */
export type VaultBinPosture = {
    source: 'shipped';
    bin: string;
} | {
    source: 'operator';
    bin: string;
} | {
    source: 'off';
    bin: null;
} | {
    source: 'unresolvable';
    bin: null;
    reason: string;
};
/** Resolves the absolute path of the `wicked-vault` bin; throws with the reason it cannot. */
export type VaultBinResolver = () => string;
/** What the decision is made from. The daemon's one call site (`CoreAdapter`) passes the value the
 *  process booted with and crew's own resolver; tests pass both explicitly, so no case depends on
 *  the importing process's environment. */
export interface VaultBinInputs {
    /** The operator's `WICKED_VAULT_BIN` as the process booted: `undefined` = none set. */
    operator: string | undefined;
    resolve: VaultBinResolver;
}
/**
 * The absolute path of crew's own `wicked-vault` bin: the installed package's `bin.wicked-vault`
 * file (`wicked-vault/package.json`, resolved from this module and never loaded). On Windows the
 * engine cannot start a `.mjs` file, so the path is npm's `.cmd` shim for that bin, which npm writes
 * into the `.bin` dir of the `node_modules` holding the package. Throws when the package, its bin
 * field or the file is missing, or (POSIX) the file is not executable.
 */
export declare function resolveShippedVaultBin(platform?: NodeJS.Platform, resolvePackageJson?: () => string): string;
/**
 * Hand the engine its wicked-vault CLI in `env` before it spawns. `operator` (the value the process
 * booted with) wins, untouched (`''` = switched off, kept empty); otherwise `resolve()`'s bin is
 * exported. A bin that cannot be resolved leaves `env` as it was and is reported — it never fails boot.
 *
 * Every input is a plain parameter, deliberately: a default of `BOOT_VAULT_BIN` here would be
 * substituted for an explicit `undefined` too (that is what a default parameter does), so a caller
 * saying "no operator value" would silently get the importing process's environment instead. The
 * daemon passes `BOOT_VAULT_BIN` itself (`CoreAdapter`).
 */
export declare function applyVaultBinEnv(env: NodeJS.ProcessEnv, resolve: VaultBinResolver, operator: string | undefined): VaultBinPosture;
/** The `/health.warnings[]` entry for a posture (the message carries the remedy), or `null`. */
export declare function vaultBinWarning(p: VaultBinPosture): HealthWarning | null;
/** `/diagnostics.vault`: what the engine is handed, and the finding with its remedy. */
export declare function vaultDiagnostics(p: VaultBinPosture): DiagnosticsVault;
//# sourceMappingURL=vault-bin.d.ts.map