/** Result of a two-layer boundary check. */
export interface GuardVerdict {
    /** True if the write is permitted. */
    allowed: boolean;
    /**
     * Operator-readable rejection reason. Set when allowed=false. Includes
     * the canonical "fix the bug in forge-engineer/forge-bugfixer" pointer
     * and the resolved absolute path.
     */
    reason?: string;
    /**
     * Absolute path the guard evaluated (after path.resolve). Always set so
     * audit logs and tests can reference it without re-resolving.
     */
    resolvedPath: string;
}
/**
 * Decide whether a write/edit targeting `targetPath` is permitted under the
 * two-layer boundary.
 *
 * @param targetPath  The path arg from a write/edit tool call. May be
 *                    relative or absolute, may contain `..` segments.
 * @param cwd         The forge-cli runtime working directory. The boundary
 *                    is `<cwd>/forge/forge/meta/` (lexical).
 *
 * Pure: no fs I/O. path.resolve canonicalizes `..` purely lexically.
 */
export declare function checkTwoLayerBoundary(targetPath: string, cwd: string): GuardVerdict;