import type { Host } from "../host/host.js";
/** The post-approval half of a file read whose bytes are read by someone
 *  else (the reply pipeline, the llm message builder). `spelling` is the
 *  string the approver saw in the interrupt payload. `fixedPath` refuses
 *  a symlink that appeared while the prompt was pending; `stat` reports a
 *  link at the final name as missing and refuses anything that is not a
 *  regular file. What is left is the check-then-open window that
 *  docs/dev/stdlib/contained-files.md leaves to process containment.
 *  Same shape as the preflight in speech.ts before a transcribe. */
export declare function approvedFilePath(host: Host, spelling: string): Promise<string>;
/** The post-approval read of a file whose bytes are sent to another
 *  process, such as the vision server, so that process never opens a
 *  path itself. The same checks as `approvedFilePath`, then one read
 *  through a validated descriptor. Refuses a file over `maxBytes` before
 *  reading it. */
export declare function approvedFileBytes(host: Host, spelling: string, maxBytes: number): Promise<Uint8Array>;
/** The same check under the underscore name the `.agency` wrappers
 *  import, so `viewFile` and `readTextWithModel` read the way every
 *  other stdlib helper call reads. */
export declare function _approvedFilePath(spelling: string): Promise<string>;