/**
 * Host filesystem bridge — serves the folders named in the mount table
 * (`--mount=<os-path>:<slicc-path>`) to the webapp over the local /api
 * surface, so configured mounts appear in the VFS fully automatically,
 * with no File System Access picker and no Chrome permission prompt.
 *
 * Only paths under a configured mount root are reachable. Every request
 * names a mount by its SLICC target (`?mount=/mnt/project`) plus a
 * mount-relative path (`?path=sub/file.txt`); the mapping to the OS root
 * happens here and `resolveWithinRoot` rejects traversal (`..`) and
 * symlink escapes, so the browser never addresses the host filesystem
 * directly.
 *
 * Protected like every other /api route: same-origin / loopback callers
 * pass, cross-origin callers need the bridge token (see
 * `createThinBridgeCorsMiddleware` in index.ts).
 */
import type { Express } from 'express';
import type { HostMountMapping } from './runtime-flags.js';
/** Matches the webapp's hostfs body cap (backend-hostfs.ts). */
export declare const HOSTFS_MAX_BODY_BYTES: number;
/**
 * Resolve `relPath` against `root`, rejecting anything that leaves the root
 * either lexically (`..`) or via symlinks. Symlinks *inside* the root that
 * also point inside the root are followed; a link pointing outside is
 * rejected. The check walks to the nearest existing ancestor so that writes
 * to not-yet-existing paths are still validated.
 */
export declare function resolveWithinRoot(root: string, relPath: string): Promise<string>;
interface HostMountRoot {
    /** SLICC target path, e.g. /mnt/project. */
    path: string;
    /** realpath()'d OS root. */
    root: string;
}
/**
 * Resolve the configured mappings to realpath'd roots. Mappings whose OS
 * path does not exist (or is not a directory) are dropped with a warning —
 * a missing folder must not take the whole /api surface down, and the
 * webapp will surface the absent mount as "not mounted".
 */
export declare function resolveHostMountRoots(mounts: readonly HostMountMapping[], warn?: (msg: string) => void): Promise<HostMountRoot[]>;
/**
 * Register the /api/hostfs routes for the resolved mount roots. The route
 * surface mirrors `MountBackend` 1:1 (webapp `backend-hostfs.ts`):
 *
 *   GET    /api/hostfs/list?mount=&path=          → { entries: [...] }
 *   GET    /api/hostfs/stat?mount=&path=          → { kind, size, mtime }
 *   GET    /api/hostfs/read?mount=&path=          → octet-stream body
 *   PUT    /api/hostfs/write?mount=&path=         ← octet-stream body
 *   POST   /api/hostfs/mkdir?mount=&path=
 *   DELETE /api/hostfs/remove?mount=&path=[&recursive=1]
 *
 * Errors are `{ code, message }` JSON with an errno-derived status so the
 * webapp backend can rethrow faithful `FsError`s.
 */
export declare function registerHostFsRoutes(app: Express, roots: readonly HostMountRoot[]): void;
export {};