export declare class WorkspaceBoundaryError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
declare const SEP: "/" | "\\";
declare const isWindows: boolean;
/**
 * A canonical platform key used for membership comparisons. On Windows this is
 * case-insensitive and drive-letter-normalized; on POSIX it is byte-identical.
 */
export declare function canonicalKey(p: string): string;
export interface BoundaryCheckOptions {
    /** Reject NUL and malformed input. Default true. */
    validateInput?: boolean;
    /** Reject UNC paths (Windows). Default true. */
    rejectUnc?: boolean;
    /** Reject absolute paths outside root entirely (single-root containment). Default true. */
    contained?: boolean;
}
/**
 * Canonical workspace-root enforcement for every path-bearing mutation.
 *
 * Normalizes absolute/relative/`..` paths, resolves symlinks (and Windows
 * junctions/reparse points via realpath), and rejects anything that escapes the
 * authorized root. Callers must re-run `assertParentWithin` immediately before
 * the physical write to narrow the TOCTOU window.
 */
export declare class WorkspaceBoundary {
    readonly root: string;
    private readonly rootReal;
    private constructor();
    static create(root: string): Promise<WorkspaceBoundary>;
    get effectiveRoot(): string;
    private assertInput;
    /**
     * Resolve an input path (absolute or relative to the workspace root) to an
     * absolute path that is guaranteed to be within the real workspace root.
     * Throws WorkspaceBoundaryError on escape.
     */
    resolveWithin(input: string): Promise<string>;
    /**
     * Revalidate the resolved parent directory of a target immediately before a
     * write, protecting against the parent directory being swapped for a symlink
     * to an external directory after the initial validation.
     */
    assertParentWithin(targetAbs: string): Promise<void>;
    private resolvedRealtarget;
    /** True when a path already exists as a symlink (for rollback/restore). */
    isSymlink(abs: string): Promise<boolean>;
}
/** Reject NUL and throw for secret-bearing paths when so requested. */
export declare function validatePathInput(p: string, rejectNul?: boolean): string;
export { isWindows, SEP };
/** Strip a leading home dir from display purposes (never used for containment). */
export declare function displayPath(p: string): string;
export declare function pathExists(abs: string): Promise<boolean>;
//# sourceMappingURL=boundary.d.ts.map