import type { ChunkRequiredSignal, DocHeading } from "./types.js";
/** Extensions allowed for write/create/delete operations. */
export declare const WRITABLE_EXTENSIONS: Set<string>;
/** Extensions recognized for read/skim/search operations. */
export declare const DOCUMENT_EXTENSIONS: Set<string>;
/** Line-count threshold above which writes return a chunk_required signal. */
export declare const CHUNK_WRITE_THRESHOLD = 600;
/** Maximum file size in bytes (10 MB) — prevents DoS from large file reads. */
export declare const MAX_FILE_SIZE: number;
/**
 * Governance write denylist patterns.
 * Exact file matches and `/**`-suffixed directory prefixes.
 */
export declare const GOVERNANCE_WRITE_DENYLIST: readonly [".hivemind/**", ".opencode/**", "opencode.json", "AGENTS.md", "CLAUDE.md", "src/AGENTS.md"];
/**
 * Resolve a document path within the project root.
 *
 * @param projectRoot - Trusted project root.
 * @param candidate - Caller-provided file or directory path.
 * @returns Absolute in-scope path.
 */
export declare function resolveDocPath(projectRoot: string, candidate: string): string;
/**
 * Resolve a document path with defense-in-depth symlink-traversal protection.
 *
 * Layers a realpath check on top of the lexical check performed by
 * `assertPathWithinRoot`. If the candidate file exists, its realpath is
 * resolved via `realpathSync.native` (OS-level, follows the full symlink
 * chain) and the resolved path is verified to stay inside the realpath of
 * the project root. If the candidate does not exist (new file case), the
 * nearest existing parent is resolved and checked instead — preventing
 * escapes via parent-directory symlinks.
 *
 * @param projectRoot - Trusted project root.
 * @param candidate - Caller-provided file or directory path.
 * @param operation - Operation name (for the `[Harness]` error prefix).
 * @returns Absolute in-scope path whose realpath stays inside the project root.
 * @throws {Error} When the resolved realpath escapes the project root.
 */
export declare function resolveSafeDocPath(projectRoot: string, candidate: string, operation: string): string;
/**
 * Convert an absolute path to deterministic project-root-relative POSIX format.
 *
 * @param projectRoot - Trusted project root.
 * @param filePath - Absolute file path inside the project root.
 * @returns POSIX-style relative path.
 */
export declare function toRootRelativePath(projectRoot: string, filePath: string): string;
/**
 * Check whether a file path uses an extension in the given set.
 *
 * @param filePath - Absolute or relative file path.
 * @param extensions - Set of valid extensions (e.g. WRITABLE_EXTENSIONS).
 * @returns True when the file extension is in the set.
 */
export declare function hasAllowedExtension(filePath: string, extensions: Set<string>): boolean;
/**
 * Throws if file extension is not in WRITABLE_EXTENSIONS.
 *
 * @param filePath - Absolute file path to check.
 * @throws {Error} When extension is not writable.
 */
export declare function assertWritableExtension(filePath: string): void;
/**
 * Throws if normalized relative path matches governance denylist.
 *
 * @param filePath - Absolute file path to check.
 * @param projectRoot - Trusted project root.
 * @param allowGovernance - If true, bypass denylist check.
 * @throws {Error} When path matches governance denylist and allowGovernance is false.
 */
export declare function assertGovernanceWriteAllowed(filePath: string, projectRoot: string, allowGovernance?: boolean): void;
/**
 * Returns ChunkRequiredSignal if file exceeds CHUNK_WRITE_THRESHOLD lines, or null.
 *
 * @param filePath - Absolute file path to check.
 * @param outline - Document heading outline for the signal.
 * @returns ChunkRequiredSignal if file is too large, null otherwise.
 */
export declare function checkChunkThreshold(filePath: string, outline?: DocHeading[]): ChunkRequiredSignal | null;
/**
 * Throws if file stat size exceeds MAX_FILE_SIZE (skips if not exists).
 *
 * @param filePath - Absolute file path to check.
 * @throws {Error} When file size exceeds MAX_FILE_SIZE.
 */
export declare function assertFileSizeWithinLimit(filePath: string): void;
//# sourceMappingURL=safety.d.ts.map