import { type BigIntStats } from "node:fs";
export declare function need(value: unknown, code: string): asserts value;
/** The owner of a directory can rename or replace its entries whatever its
 * mode, so an ancestor must belong to root or the current user. There is no
 * allowlist: a prefix such as /opt/homebrew passes only when one of them owns it. */
export declare function trustedAncestorOwner(uid: number | bigint): boolean;
/** Every ancestor directory of `file`: a real directory, owned by root or the
 * current user, and writable by neither group nor others unless it is a
 * root-owned sticky directory. Throws CODEX_HOOK_TRUST_UNSAFE_PARENT. */
export declare function safeParents(file: string): void;
/** The path a symbolic link names, when that text cannot pass through another
 * link: an absolute text of plain names, or a relative text that leaves the
 * link's own directory only through leading `..` components and then names
 * plain entries. Undefined for any other text. The caller has verified the
 * link's directory chain as real directories, so the leading `..` steps stay
 * on verified directories, and requires the result to equal realpath, which
 * proves that no named component is itself a link: the command leaf is then
 * the only alias in the chain. */
export declare function directAliasTarget(link: string): string | undefined;
export declare function snapshot(file: string, privateFile?: boolean, options?: {
    readOnlyPackage?: true;
}): {
    file: string;
    privateFile: boolean;
    readOnlyPackage: boolean;
    text: string;
    bytes: Buffer<ArrayBuffer>;
    stat: BigIntStats;
    sha256: string;
};
export declare function unchanged(before: ReturnType<typeof snapshot>): void;
export declare function save(file: string, content: string | Buffer): void;