/** An entry containing none of these is a plain path; any other is a glob
 *  matched by globToRegExp. */
export declare function isGlobScope(entry: string): boolean;
/** A scope entry as a deny message names it, saying how it matches so a role
 *  is not told it "may use" a directory it then cannot write inside. */
export declare function describeScope(entry: string): string;
/** A directory grant as the operator configured it: `lexical` is the entry
 *  resolved against the org workdir's real path, `real` its real path at
 *  snapshot time. `refused` says why it grants nothing. */
export interface ScopeSnapshot {
    lexical: string;
    real: string;
    refused?: string;
}
/**
 * #496: `real` differs from `lexical` only because realpathSync.native gave
 * the on-disk case (darwin/win32): no part of `lexical` is a symlink and the
 * two differ in case alone. Then `site` for a directory named `Site` is that
 * directory, not a symlink to it.
 */
export declare function onDiskSpelling(lexical: string, real: string, platform?: NodeJS.Platform): boolean;
/** Snapshot one non-glob entry. A missing entry snapshots its lexical path. */
export declare function snapshotScopeEntry(entry: string, cwd: string, home?: string): ScopeSnapshot;
/** Snapshots for every non-glob fileWrite/fileRead entry, keyed by entry. */
export declare function snapshotScopes(policy: {
    fileWrite?: string[];
    fileRead?: string[];
} | undefined, cwd: string): Map<string, ScopeSnapshot>;
/** A deny reason when a snapshotted entry no longer resolves to the path it
 *  had at startup (swapped for, or created as, a symlink), else undefined. */
export declare function scopeDrift(entry: string, snap: ScopeSnapshot): string | undefined;
/** `org validate` findings for scope entries (placeholders already expanded):
 *  errors for a directory grant that would be refused at runtime, warnings for
 *  a missing absolute path (likely a typo) and a relative path leaving the
 *  role's workdir. Relative entries are otherwise checked at runtime, where the
 *  workdir is known. */
export declare function scopeEntryFindings(roles: {
    id: string;
    policy?: {
        fileWrite?: string[];
        fileRead?: string[];
    };
}[], home?: string): {
    errors: string[];
    warnings: string[];
};
//# sourceMappingURL=policy-scopes.d.ts.map