/**
 * scanLocalhostFallback — ported from
 * `scripts/guard-no-localhost-fallback.mjs`.
 *
 * Refuse to let production code use the literal `local@localhost` (or the
 * `DEV_MODE_USER_EMAIL` symbolic alias) as a fallback identity when no
 * session is present — that pools every unauthenticated request onto one
 * shared tenant. The right behavior in production is to throw/401 when
 * there's no session, not fall back to a sentinel identity.
 *
 * Conditional guard — per report 005's V1 guard set table: the original
 * hardcodes framework-file exemptions (`packages/core/src/server/auth.ts`,
 * `packages/core/src/org/context.ts`, etc. — files that either define or
 * intentionally handle the dev-mode sentinel). Those live in `node_modules`
 * for a generated app and are already excluded by `SKIP_DIRS`, so they're
 * moved behind an optional `extraExemptPaths` param (default `[]`) instead
 * of hardcoded. The generic allowlist predicates (`*.spec.*`, `*.test.*`,
 * `scripts/**`, `**\/seed(s)/**`) are kept verbatim.
 *
 * Also refuses to let request-handling code answer "who is the caller" with the
 * ambient process identity (`?? process.env.AGENT_USER_EMAIL`,
 * `|| process.env.WORKSPACE_OWNER_EMAIL`, `?? getAmbientUserEmail()`). That
 * shape fails open toward more privilege: an admin gate reading it admits
 * whoever the deploy env names rather than whoever signed in. CLI, cron, seed
 * and test paths are exempt because they have no request by construction.
 *
 * Opt-out (same line, or the line immediately above):
 *   const x = email ?? "local@localhost" // guard:allow-localhost-fallback — short reason
 */
import type { GuardResult, GuardScanOptions } from "./types.js";
export interface LocalhostFallbackOptions extends GuardScanOptions {
    /** Exact repo-relative paths to exempt in addition to the generic
     * predicates (spec/test/scripts/seed). Default `[]`. */
    extraExemptPaths?: string[];
}
export declare function scanLocalhostFallback(options: LocalhostFallbackOptions): GuardResult;
//# sourceMappingURL=no-localhost-fallback.d.ts.map