export declare class FileAccessDeniedError extends Error {
    constructor(filePath: string);
}
/**
 * Assert that a file path is within an allowed directory.
 * Throws FileAccessDeniedError if not.
 *
 * Allowed directories:
 *   - The active vault root (if one exists)
 *   - ~/.phaibel/ (always allowed for config/state access)
 */
export declare function assertPathAllowed(filePath: string): Promise<void>;
/**
 * Synchronous variant for use in sync NodeCode paths.
 * Requires the vault root to be passed in explicitly.
 */
export declare function assertPathAllowedSync(filePath: string, vaultRoot: string | null): void;
//# sourceMappingURL=file-access-guard.d.ts.map