/**
 * Reject scoped worker roots that contain a symlink escape.
 *
 * Deno authorizes reads using the symlink location rather than its resolved
 * target. Project workers cannot create new symlinks because write access is
 * denied. Use {@link createWorkerReadScopeGenerationAudit} for pooled workers
 * so this full-tree scan runs once per immutable source generation.
 */
export declare function assertWorkerReadScopeConfined(readScope: readonly string[] | boolean): void;
/**
 * Create a successful-once read-scope audit for one immutable worker source
 * generation.
 *
 * Host source changes must rotate the worker generation identity or evict its
 * pool scope. The replacement worker receives a new audit and scans the new
 * tree before startup. Reusing this closure across mutable source generations
 * would violate that host-owned lifecycle contract.
 */
export declare function createWorkerReadScopeGenerationAudit(readScope: readonly string[] | boolean): () => void;
//# sourceMappingURL=worker-read-scope.d.ts.map