/**
 * Filesystem safety utilities for preventing symlink traversal and oversized file ingestion.
 *
 * Uses `lstatSync` (which does NOT follow symlinks) to inspect entries before
 * any content is read, closing the data-leak vector where a symlink pointing
 * at `/etc/passwd` (or similar) would be indexed into FTS5.
 */
/**
 * Result of a path safety check.
 */
export interface PathSafetyResult {
    safe: boolean;
    reason?: string;
}
/**
 * Options for `checkPathSafety`.
 */
export interface PathSafetyOptions {
    /** Maximum allowed file size in bytes. Files larger than this are rejected. */
    maxFileSize?: number;
}
/**
 * Check whether a filesystem path is safe to read.
 *
 * - Rejects symbolic links (prevents data leaks from outside the plans tree).
 * - Rejects files exceeding `maxFileSize` (prevents OOM from multi-MB files).
 *
 * Uses `lstatSync` so the check never follows symlinks.
 *
 * @param fullPath - Absolute path to check
 * @param options - Safety options (maxFileSize)
 * @returns Safety result with reason if unsafe
 */
export declare function checkPathSafety(fullPath: string, options?: PathSafetyOptions): PathSafetyResult;
/**
 * Check whether a path is a symbolic link.
 *
 * Convenience wrapper around `lstatSync().isSymbolicLink()`.
 * Returns `false` if the path does not exist or cannot be stat'd.
 */
export declare function isSymlink(fullPath: string): boolean;
/**
 * Check if a path or any of its ancestor directories are symlinks.
 *
 * This prevents traversal attacks via symlinked parent directories
 * (e.g., `plans/linked/secret.md` where `plans/linked` is a symlink).
 *
 * @param fullPath - Absolute path to check
 * @param root - Root directory to stop checking at
 * @returns PathSafetyResult indicating if any ancestor is a symlink
 */
export declare function checkSymlinkAncestors(fullPath: string, root: string): PathSafetyResult;
/**
 * Check if a path's realpath is contained within a root directory.
 *
 * This prevents symlink traversal by verifying the resolved path
 * stays within the intended directory tree.
 *
 * @param fullPath - Absolute path to check
 * @param root - Root directory that should contain the path
 * @returns PathSafetyResult indicating containment
 */
export declare function checkPathContainment(fullPath: string, root: string): PathSafetyResult;
//# sourceMappingURL=fs-safety.d.ts.map