/** Content addressing and lightweight security guards for workspace indexing. */
export declare function sha256(input: string | Buffer): string;
/** Constant-time string equality (for internal integrity checks). */
export declare function safeEqual(a: string, b: string): boolean;
/**
 * Validate that a workspace-relative target stays inside the workspace root.
 * Rejects absolute paths, parent traversal, and empty targets.
 */
export declare function assertInsideWorkspace(root: string, relative: string): string;
/**
 * Detect a symlink escape: a resolved real path that leaves the workspace root.
 * Returns the escaped path or null when safe.
 */
export declare function detectSymlinkEscape(root: string, candidate: string): string | null;
/** Reject characters that could enable an FTS/query injection from untrusted text. */
export declare function sanitizeQueryTerm(term: string): string;
export declare function isSuperficiallyBinary(buf: Buffer): boolean;
//# sourceMappingURL=guard.d.ts.map