/**
 * EVO-12 hosted MCP — read-only tool allowlist (the load-bearing security
 * invariant, DEC-116 / EVO-11 key custody).
 *
 * The internet-facing hosted MCP (enrolled from claude.ai) exposes ONLY read
 * tools. No tool that takes a private key is ever routable on the hosted
 * surface, so the ed25519 private key never travels over the wire. Signing
 * stays on the keyring-holding side (local CLI / sidecar). This is a STRUCTURAL
 * deployment property, not a phase: `hostedReadOnlyDescriptors` throws if the
 * allowlist ever contains a private-key tool (defense-in-depth schema scan).
 */
import type { McpToolDescriptor, McpToolName } from "../mcp/tools.js";
/** Phase-1 read-only surface: "claude.ai has the info" (discover / nhi / posture). */
export declare const H2A_HOSTED_READONLY_TOOLS: readonly McpToolName[];
/** True iff the tool's input schema carries a private key (must never be hosted). */
export declare function toolTakesPrivateKey(descriptor: McpToolDescriptor): boolean;
export declare function isHostedReadOnlyTool(name: string): boolean;
/**
 * The read-only descriptor subset to expose on the hosted MCP. THROWS if any
 * allowlisted tool takes a private key — the allowlist must never include a
 * signing tool (structural invariant, not a runtime hope).
 */
export declare function hostedReadOnlyDescriptors(all: readonly McpToolDescriptor[]): McpToolDescriptor[];
//# sourceMappingURL=readonly-allowlist.d.ts.map