export type GuardErrorCode = "PATH_OUTSIDE_ROOT" | "PATH_HIDDEN_FILE" | "PATH_NOT_FOUND" | "PATH_NOT_FILE" | "PATH_SYMLINK_ESCAPES_ROOT";
export interface GuardError {
    ok: false;
    code: GuardErrorCode;
    message: string;
}
export interface GuardSuccess {
    ok: true;
    /** Absolute, fully-resolved (symlinks-followed) path safe to read. */
    resolvedPath: string;
    /** Basename of the resolved file. Safe to surface to the LLM. */
    basename: string;
    /** The configured upload root at the time of the check. */
    uploadRoot: string;
}
export type GuardResult = GuardSuccess | GuardError;
/** Get the configured upload root. Resolves the env var or process.cwd(). */
export declare function getUploadRoot(): string;
/**
 * Validate a user-supplied filesystem path against the upload-root policy.
 * Returns either a resolved absolute path that is safe to read, or a
 * structured error describing why the path was rejected.
 */
export declare function guardUserPath(userPath: string): Promise<GuardResult>;
//# sourceMappingURL=path-guard.d.ts.map