/**
 * helpers.ts — Aggregated re-export barrel (I-ARCH-03)
 *
 * @deprecated since v0.19.0 — Import directly from the split modules instead:
 *   - src/core/path-utils.ts    (path security, traversal protection)
 *   - src/core/config-parser.ts  (config parsing, MCP output parsing)
 *   - src/core/file-scanner.ts   (recursive file scanning)
 *
 * This file re-exports everything for backward compatibility.
 * 37 import sites continue to work without changes.
 * TODO: v0.20.0 remove barrel — migrate all import sites to direct module imports.
 */
export { iterativeDecode, resolvePath, validatePath, validateProjectRoot, safeRealPath, resolveWithinRoot, normalizeUserProjectPath, getAllowedProjectPaths, isPathInAllowedRoots, describeAllowedRoots, _resetPathAllowWarned, } from './core/path-utils.js';
export { parseConfigValue, parseGodotConfig, parseMcpScriptOutput, } from './core/config-parser.js';
export type { GodotConfig } from './core/config-parser.js';
export { scanFiles, DEFAULT_SKIP_DIRS, } from './core/file-scanner.js';
export declare function ensureDir(p: string): void;
/** Require a non-empty string from tool args. */
export declare function requireString(args: Record<string, unknown>, key: string): string;
/** Require a finite number from tool args. */
export declare function requireNumber(args: Record<string, unknown>, key: string, fallback?: number): number;
/**
 * Check whether the user has explicitly allowed paths outside the project root.
 *
 * Returns true when:
 * - GODOT_MCP_UNRESTRICTED=true (dev mode), OR
 * - ALLOWED_PROJECT_PATHS is configured (explicit opt-in)
 *
 * When false, callers should use resolveWithinRoot() to restrict paths.
 * When true, callers should still validate with isPathInAllowedRoots().
 *
 * @deprecated since v0.18.0, removal in v0.20.0 — prefer isPathInAllowedRoots() directly.
 */
export declare function allowOutsideProjectPaths(): boolean;
/** Convenience: require and validate project_path in one call. */
export declare function requireProjectPath(args: Record<string, unknown>): string;
/**
 * Build a sanitized environment for Godot child processes.
 *
 * SECURITY NOTE (I-04): The following user-directory variables are passed
 * because Godot needs them to locate editor data, cache, and config:
 * HOME, USERPROFILE, LOCALAPPDATA, APPDATA, XDG_*, DISPLAY.
 * All other env vars are stripped to prevent credential leakage to child processes.
 *
 * S4/S5 (2026-06-24): GODOT_MCP_BRIDGE_* prefixed vars are passed through.
 * This is the mcp_bridge.gd runtime config sub-namespace (toggles like
 * GODOT_MCP_BRIDGE_PERSISTENT_SECRET / GODOT_MCP_BRIDGE_EXTRA_METHODS), NOT user
 * credentials. Stripping them at the spawn boundary silently breaks the GDScript-side
 * fixes — the env switch never flips, so the secret-reuse / method-whitelist logic
 * never runs.
 *
 * S4-editor (2026-07-11): GODOT_MCP_EDITOR_* added symmetrically — editor plugin
 * (addons/godot_mcp_server/websocket_server.gd) reads GODOT_MCP_EDITOR_PERSISTENT_SECRET
 * at _ready via OS.get_environment(); launch_editor spawns the editor with buildSafeEnv,
 * so without passthrough the env is stripped and PERSISTENT never triggers. Same
 * sub-namespace rule (runtime config, NOT credentials).
 *
 * Scope is intentionally narrow (GODOT_MCP_BRIDGE_ / GODOT_MCP_EDITOR_, not bare
 * GODOT_MCP_): server-side
 * security/sandbox switches (GODOT_MCP_UNRESTRICTED, GODOT_MCP_ALLOW_UNSAFE,
 * ALLOW_EXECUTE_GDSCRIPT, ALLOWED_PROJECT_PATHS) MUST stay stripped — a child
 * process must not unlock its own restrictions. See gdscript-executor-core.test.js.
 */
export declare function buildSafeEnv(): NodeJS.ProcessEnv;
export declare function checkVersionMismatch(projectPath: string, godotBin: string): Promise<string | null>;