/**
 * Read HOUSE_ADMIN_SCOPE for the plugin, fail-closed. HOUSE_ADMIN_SCOPE is the
 * whole boundary: it is present in the spawn env ONLY for a house role:admin
 * session (Task 1440), and it reaches this server by INHERITANCE from that
 * env — never from a declared env block. Task 1700 deleted this plugin's
 * `HOUSE_ADMIN_SCOPE: ${HOUSE_ADMIN_SCOPE}` declaration: the key is not in the
 * platform placeholder map, so declaring it could only ever yield the literal
 * `${HOUSE_ADMIN_SCOPE}` string (which is truthy), and the `mcp-manifest: auto`
 * generator discards the block anyway. Do not restore the declaration.
 *
 * The literal-placeholder guard below stays as defence in depth. Since Task
 * 1700 the platform drops an unresolvable key rather than emitting its literal,
 * so no loader should now deliver one — but treating a literal placeholder or
 * an empty value as "no scope" keeps a non-house session deterministically
 * fail-closed regardless of loader behaviour: the read never trusts a value it
 * did not receive as a real scope. (This is why the plugin does not call the
 * shared `readHouseAdminScope`, whose truthy test would accept the literal.)
 */
export declare function readPluginHouseScope(env: NodeJS.ProcessEnv): string | null;
export interface Ctx {
    /** The session's own account (spawn env ACCOUNT_ID). */
    ownAccountId: string;
    /** HOUSE_ADMIN_SCOPE from the spawn env; null for any non-house session. */
    houseScope: string | null;
    /** `<install>/data/accounts` — the root that all account dirs live under. */
    accountsDir: string;
}
export type ResolveRootResult = {
    root: string;
    resolved: string;
} | {
    reject: "cross-account-denied" | "cross-account-invalid-target" | "cross-account-target-not-provisioned";
};
/**
 * Resolve the account directory a tool call acts on, gated fail-closed. Emits
 * the standing [xacct] decision line for every call and op=fs-root on allow.
 * `root` is `<accountsDir>/<resolved>` — the strict filesystem root the caller
 * must contain every path within.
 */
export declare function resolveRoot(ctx: Ctx, targetAccountId: string | undefined, tool: string): ResolveRootResult;
/**
 * Resolve `relPath` against the account `root` and prove it stays inside.
 * Lexical containment rejects `../` and absolute-path escapes; a realpath check
 * on the deepest EXISTING ancestor rejects symlink escapes and still permits a
 * not-yet-existing (create) target. Throws Error("path-escape") after emitting
 * op=path-escape-reject; the caller surfaces it as an isError tool result.
 */
export declare function containedPath(root: string, relPath: string): string;
//# sourceMappingURL=scope.d.ts.map