/** The environment variables toolchainPaths reads (its memo key). */
export declare const TOOLCHAIN_ENV: readonly ['PATH', 'XDG_DATA_HOME', 'XDG_STATE_HOME', 'XDG_CONFIG_HOME', 'MISE_DATA_DIR', 'MISE_CONFIG_DIR', 'MISE_STATE_DIR', 'NVM_DIR', 'VOLTA_HOME', 'FNM_DIR', 'ASDF_DATA_DIR', 'BUN_INSTALL', 'PNPM_HOME', 'CARGO_HOME', 'RUSTUP_HOME', 'PYENV_ROOT', 'RBENV_ROOT', 'GOPATH', 'GOBIN'];
/** Binaries looked up on PATH. */
export declare const TOOLCHAIN_BINARIES: string[];
/** The XDG base directories, with their $HOME defaults. */
export declare function xdgDirs(home: string, env: NodeJS.ProcessEnv): {
    data: string;
    state: string;
    config: string;
};
/** A manager path, and the root whose use makes it relevant before it
 *  exists. `precreate`: created empty at org start when in use and absent,
 *  so it is bound read-only and never "appears" to the planted-path watch
 *  when the operator later installs into it. */
export interface ManagerPath {
    path: string;
    /** An environment variable chose it, or its tool is in use. */
    named: boolean;
    anchor: string;
    precreate?: boolean;
}
/** The known version-manager and global-install locations. bun keeps its
 *  package cache beside its global installs: only those are protected.
 *  pnpm's home is protected whole (it is on PATH, where one new file
 *  shadows `git`); toolchainRoleEnv moves a role's store out of it. */
export declare function versionManagerPaths(home: string, env: NodeJS.ProcessEnv): ManagerPath[];
/** Could a process running as this user write, replace or create `p`? */
export declare function roleWritable(p: string): boolean;
/** The first executable `name` on `pathVar`. */
export declare function onPath(name: string, pathVar: string | undefined): string | undefined;
/** The install root of a real file: the npm prefix of a file inside
 *  `<prefix>/lib/node_modules`, the prefix of a `<prefix>/bin/<file>`, and
 *  Claude Code's native data dir for `…/claude/versions/<ver>`. */
export declare function installRoots(file: string, home: string): string[];
/** The package root of the running CLI (the nearest package.json above
 *  this module). */
export declare function defaultPackageRoot(): string | undefined;
export interface ToolchainProbe {
    home: string;
    env: NodeJS.ProcessEnv;
    /** Defaults to process.execPath. */
    execPath?: string;
    /** Defaults to the running CLI's package root; null for none. */
    packageRoot?: string | null;
    /** Defaults to os.tmpdir(). */
    tmp?: string;
    /** Work trees: a PATH entry inside one (its node_modules/.bin) stays
     *  writable to the role that works there. */
    exclude?: string[];
}
/** Every toolchain path a role must not write; see the module doc. */
export declare function toolchainPaths(probe: ToolchainProbe): string[];
/** #527 review M2: create what toolchainPaths expects but is absent (pnpm's
 *  home, bun's global dirs, a cargo or Go bin dir in use, mise's trust
 *  store, direnv's allow list), so it is bound read-only from the start and
 *  the operator's own `pnpm add -g` never looks like a plant. Only under
 *  $HOME. */
export declare function ensureToolchainDirs(home: string, env: NodeJS.ProcessEnv): void;
/** Environment for a role's processes: its pnpm store outside the
 *  protected pnpm home (pnpm keeps the store inside it by default), and no
 *  pnpm self-install into `<pnpm home>/.tools`. An operator-set store is
 *  kept. */
export declare function toolchainRoleEnv(home: string, env: NodeJS.ProcessEnv): Record<string, string>;
/** toolchainPaths for this home, toolchain environment and set of work
 *  trees, cached until the next org or session start
 *  (ensureOperatorProtectedPaths resets it): the file tools consult it on
 *  every write. */
export declare function operatorToolchainPaths(home: string, env: NodeJS.ProcessEnv, exclude?: string[]): string[];
/** Forget the computed lists (every org and session start). */
export declare function resetToolchainMemo(): void;
/** The directories on the way to each protected path that a role could
 *  rename (their parent is writable), stopping at $HOME, the temp dir and
 *  the work tree holding the path: bound onto themselves (a mount point
 *  cannot be renamed), so no role can move `~/.local/share` aside and plant
 *  a new `mise/…` in its place. Directories inside another protected path
 *  are skipped: nothing there can be renamed. */
export declare function mountPointAncestors(paths: string[], ctx: {
    home: string;
    roots: string[];
    tmp?: string;
}): string[];
//# sourceMappingURL=operator-toolchain-paths.d.ts.map