export * from "./gitCore.js";
export * from "./gitParse.js";
/**
 * Run git against an EXPLICIT repo directory. Never inherits process.cwd():
 * empty/relative/missing cwd throws, so a lost directory can never silently
 * target the process's own repo. Prepends hardening flags, scrubs the env,
 * enforces a timeout, throws on non-zero exit (stderr as message), truncates
 * oversized output, and returns stdout.
 */
export declare function gitRunImpl(cwd: string, args: string[], opts?: {
    signal?: AbortSignal;
    env?: NodeJS.ProcessEnv;
    timeoutMs?: number;
    maxBytes?: number;
}): Promise<string>;
/** ALS-reading wrapper Agency calls; mirrors `_exec` in shell.ts. */
export declare function _gitRun(cwd: string, args: string[]): Promise<string>;
/** True when `cwd` is inside a git work tree. Never throws — a non-repo (or a
 * missing/inaccessible directory) returns false — so callers can branch on it
 * without a try. */
export declare function _gitIsRepo(cwd: string): Promise<boolean>;
/**
 * Enforce `allowedPaths` on a set of repo-relative paths using the shared
 * symlink-aware `assertContained` (the same check exec/bash/fs use). No-op
 * when allowedPaths is empty. Paths resolve against `cwd` (the repo).
 */
export declare function assertPathsContained(paths: string[], allowedPaths: string[], cwd: string): Promise<void>;
/**
 * Fail closed: `git add -A` (all=true) stages everything and ignores the
 * explicit paths list, so `allowedPaths` containment would be a no-op. Reject
 * the combination rather than silently letting `-A` escape the restriction.
 */
export declare function assertAllNotRestricted(all: boolean, allowedPaths: string[]): void;