import type { CapabilityEnvelope } from "./contracts.ts";
export declare function extractPathArguments(params: unknown): string[];
/** Tool-aware path projection shared by every envelope/gateway enforcement boundary. */
export declare function extractToolPathArguments(toolName: string, params: unknown): string[];
/**
 * Deny wins over allow; an empty/absent allow list means "no positive scope restriction"
 * (only denies apply) — mirroring the resource-profile filter semantics.
 *
 * Both the target and every scope root are resolved through the real filesystem
 * (symlinks expanded in the existing prefix) before comparison: a pre-existing symlink
 * under an allowed root cannot smuggle a write outside the scope, and a shortcut into a
 * denied subtree is still denied. An unresolvable target fails closed.
 */
export declare function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean;
export interface EnvelopeScopedTool {
    name: string;
    /**
     * The `never` parameter keeps this structural boundary compatible with both the synchronous
     * fixtures used by the path-policy tests and the strongly typed async `AgentTool.execute`
     * implementations. The wrapper itself preserves the concrete execute signature below.
     */
    execute: (...args: never[]) => unknown;
}
/**
 * Wrap a tool so path-bearing arguments are scope-checked when it RUNS, consulting canonical
 * tool capability policy so only tools whose policy declares path-scope access
 * (resolveToolCallPathAccess !== "none") are checked against envelope boundaries. The wrapped tool is
 * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).
 */
export declare function wrapToolWithEnvelopeScope<T extends EnvelopeScopedTool>(tool: T, envelope: CapabilityEnvelope, cwd: string): T;
//# sourceMappingURL=envelope-enforcement.d.ts.map