/** Why this process cannot use the operator directory, or undefined when it
 *  can (or the operator has not created it yet). */
export declare function operatorDirBlockedReason(dir: string, opts?: {
    mountinfo?: string;
}): string | undefined;
/** The plain statement of the rule, for `org sign` and `org run` in a role. */
export declare function operatorDirProtectedMessage(dir: string, why?: string): string;
/** #699: when the operator enables `org.allowDrillSigning` (operator-settings.ts;
 *  off by default), a role-run QA drill may sign a throwaway org, but only against a key
 *  of its own, never the operator's. Allowed only when the operator dir is
 *  moved (MONOMIND_ORGRT_OPERATOR_DIR) to a directory INSIDE the project being
 *  signed, and that project is not in a git work tree. A signature made this
 *  way is read only by a process given the same variable; the daemon and
 *  `org serve` use the real operator dir, so it never applies to a real org
 *  (those live in a repository), and nothing is written to the operator dir. */
export declare function drillSigningScope(root: string, env?: NodeJS.ProcessEnv, 
/** Whose operator settings decide; the passwd home unless a test says. */
settingsHome?: string): {
    ok: true;
} | {
    ok: false;
    reason: string;
};
//# sourceMappingURL=operator-dir-guard.d.ts.map