/**
 * Path checks for MCP tools that read or write a caller-named file.
 *
 * Paths in tool input come from whoever drives the MCP server, including a
 * model following injected instructions. A tool that writes or reads such a
 * path must keep it inside the project directory, and must not follow a
 * symlink out of it.
 */
/**
 * Resolve a caller-named output file inside the project. The real parent
 * directory must be inside the real project root and outside `.git`, and an
 * existing target must be a regular, non-executable file — not a symlink.
 * `extensions`, when given, lists the allowed lower-case file extensions.
 */
export declare function containedWritePath(p: string, extensions?: readonly string[]): string | null;
/** Resolve a caller-named input file inside the project: a regular file, not a symlink. */
export declare function containedReadPath(p: string): string | null;
/**
 * Check a caller-named memory database path. It may live outside the project
 * (the CLI's `--path` flag passes one), so this does not contain it; instead
 * it refuses anything that is not plainly a SQLite database (plaintext, or
 * encrypted at rest per ADR-096), so the memory tools cannot be pointed at and
 * overwrite an unrelated file.
 */
export declare function dbPathError(p: string): string | null;
/**
 * Marks a tool call made by the local CLI on the operator's behalf (for
 * example `ruflo memory export --output ~/backup.json`). MCP requests arrive
 * as JSON and cannot carry a symbol key, so this cannot be forged remotely.
 */
export declare const LOCAL_CLI_CALL: unique symbol;
export declare function localCliContext(): Record<string, unknown>;
export declare function isLocalCliCall(context: unknown): boolean;
//# sourceMappingURL=path-containment.d.ts.map