/**
 * Path-traversal defence for the preview content route (`/preview/<sid>/...`).
 *
 * Resolves a user-supplied relative `path` against a per-session `baseDir`
 * and rejects anything that escapes (including symlink-based escapes via
 * `realpathSync`). Implements the algorithm specified in the design doc §3.
 */
export type PathGuardResult = {
    ok: true;
    resolved: string;
    size: number;
} | {
    ok: false;
    status: 400 | 404;
    error: string;
};
/**
 * Resolve `rel` under `baseDir` and return the absolute path if safe, or a
 * structured error for the asset route to translate to an HTTP response.
 *
 * Mutually exclusive outcomes (in order of precedence):
 *
 *   400 — input shape rejected (missing, NUL, absolute, backslash) or
 *         resolved path escapes baseDir (including via symlinks).
 *   404 — resolved path doesn't exist OR isn't a regular file.
 *   ok  — path is safe to stream, returns absolute resolved path + size.
 *
 * Note: there is no size cap here. Asset inclusion into the mount is
 * agent-driven and explicit (see `mountFile` in `mount.ts`); the agent is
 * responsible for declaring only what it needs.
 */
export declare function resolveAssetPath(baseDir: string, rel: string | null | undefined): PathGuardResult;
//# sourceMappingURL=path-guard.d.ts.map