import { type RaceSafeReadOptions, type RaceSafeReadResult } from '../../platform/fs/race-safe-read.js';
export type ProtectedProjectPathKind = 'missing' | 'file' | 'directory';
export interface ProtectedProjectPathInspection {
    projectRoot: string;
    target: string;
    relative: string;
    exists: boolean;
    kind: ProtectedProjectPathKind;
}
export interface ProtectedProjectPathOptions {
    label: string;
    expected?: 'file' | 'directory' | 'any';
}
export interface ProtectedProjectInstructionPath {
    projectRoot: string;
    target: string;
    relative: string;
    exists: boolean;
}
/**
 * Resolve a project-relative path while rejecting lexical traversal, special
 * filesystem objects, symlink/junction ancestors, and physical root escapes.
 */
export declare function inspectProtectedProjectPath(projectRoot: string, relativePath: string, options: ProtectedProjectPathOptions): Promise<ProtectedProjectPathInspection>;
/**
 * Resolve one of the two project instruction files without following an
 * arbitrary link. Some repositories keep a single instruction file and link
 * AGENTS.md to CLAUDE.md (or the reverse); that alias is safe only when the
 * target is the other instruction file in this same project root.
 */
export declare function resolveProtectedProjectInstructionPath(projectRoot: string, relativePath: string): Promise<ProtectedProjectInstructionPath>;
/**
 * Create a project-relative directory one segment at a time. Every existing or
 * newly-created segment is checked with lstat and realpath before the next
 * segment is touched, so a symlink, junction, special object, or physical root
 * escape fails closed.
 */
export declare function ensureProtectedProjectDirectory(projectRoot: string, relativePath: string, options: {
    label: string;
}): Promise<string>;
export declare function protectedProjectFileExists(projectRoot: string, relativePath: string, options: {
    label: string;
}): Promise<boolean>;
export declare function readProtectedProjectFile(projectRoot: string, relativePath: string, maxBytes: number, options: Omit<RaceSafeReadOptions, 'verify'> & {
    label: string;
}): Promise<RaceSafeReadResult>;
//# sourceMappingURL=protected-project-path.d.ts.map