import * as fs from "node:fs";
interface TaskFileIdentity {
    dev: bigint;
    ino: bigint;
    birthtimeNs: bigint;
}
interface TaskFileSnapshot {
    path: string;
    target?: string;
    identity?: TaskFileIdentity;
    error?: string;
}
/** Bind task files once per owner in the wrapper's invocation scope, after extension preflight. */
export declare function bindTaskFileApproval(owner: object, taskFiles: string[], resolvePath: (taskFile: string) => string | undefined): void;
/** Query bound restriction targets, or resolve paths before binding, without changing approval state. */
export declare function taskFileRestrictionPaths(owner: object, taskFiles: string[], resolvePath: (taskFile: string) => string | undefined): string[] | undefined;
/** Read the captured target for approval display without resolving paths or surfacing capture errors. */
export declare function taskFileApprovalPath(owner: object, taskFile: string): string | undefined;
/**
 * Read a captured task file without changing approval state. Return undefined for unwrapped execution;
 * within a scope, throw if the file was not bound or its capture failed.
 * Direct calls inside another tool's scope also require a binding; they are not unwrapped execution.
 */
export declare function approvedTaskFile(owner: object, taskFile: string): TaskFileSnapshot | undefined;
/** Check the opened file's identity against its approval capture; contents may still change in place. */
export declare function taskFileMatchesApproval(stat: fs.BigIntStats, snapshot: TaskFileSnapshot): boolean;
export {};