export interface MandatoryDenyReadOptions {
    parentEnv: NodeJS.ProcessEnv;
    realHome: string;
    uid?: number;
}
/**
 * Enumerate the mandatory deny-read paths that exist on this host right now.
 * Covers both tmux topologies, container sockets, SSH/GPG, D-Bus/systemd-user,
 * X11/Wayland, editor, and audio IPC (spec: "Mandatory IPC isolation is
 * independent of user policy").
 */
export declare function deriveMandatoryDenyReadPaths(opts: MandatoryDenyReadOptions): string[];
//# sourceMappingURL=mandatory-paths.d.ts.map