/**
 * #502 review: a role's (or loadout's) `instructions_file` is read by the
 * daemon — outside every role sandbox — and pasted into the role's prompt.
 * Pointed at the operator key, the dashboard secret or `~/.ssh`, it would
 * hand the role their contents.
 *
 * - The path is signed (org-signature.ts), and so is a digest of the file's
 *   content: the definition stops verifying when a role edits the file, and
 *   the daemon compares the content it reads for each session with the
 *   digest it verified at start (so an edit mid-run is not read either).
 * - The path must resolve, through every symlink, to a file inside the
 *   project and not to anything a role may not read.
 * - Reading closes the check-then-read race: the file is opened with
 *   O_NOFOLLOW, the opened descriptor must be the very inode that was
 *   checked (dev/ino), it may have no other hard link, on Linux its
 *   /proc/self/fd path is checked again, and the text comes from that fd.
 */
type Opts = {
    home?: string;
    env?: NodeJS.ProcessEnv;
};
/** The real path to read, or `{ refused }` with why. `root` is the project
 *  (org root) a relative path resolves against. */
export declare function resolveInstructionsFile(file: string, root: string, opts?: Opts): {
    path: string;
    refused?: undefined;
} | {
    path?: undefined;
    refused: string;
};
/** Read the file safely (see the module doc): its text, or why not. */
export declare function readInstructionsFile(file: string, root: string, opts?: Opts): {
    text: string;
    refused?: undefined;
} | {
    text?: undefined;
    refused: string;
};
/** What an instructions file contributes to the signature: the digest of
 *  its content, or why it can't be read (which is then signed as is). */
export declare function instructionsDigest(file: string, root: string, opts?: Opts): string;
/** The text of an instructions file whose digest must still be `expected`
 *  (the one verified at org start), or why it can't be used. */
export declare function readVerifiedInstructions(file: string, root: string, expected: string | undefined, opts?: Opts): {
    text: string;
    refused?: undefined;
} | {
    text?: undefined;
    refused: string;
};
export {};
//# sourceMappingURL=instructions-file.d.ts.map