/**
 * raw-file-path — deterministic detector for literal filesystem paths in
 * user-facing messages.
 *
 * Sibling of `localhost-link.ts`, held to the same linear-regex discipline —
 * but unlike the localhost guard this is a pure SIGNAL, never a block
 * (spec: docs/specs/outbound-jargon-filepath-gap.md §2.3). A literal repo
 * path shown to a user ("/Users/justin/...", ".instar/config.json",
 * "src/core/Foo.ts") is something the user usually can't act on; the
 * existing B2_FILE_PATH judgment belongs to the LLM authority, and on
 * automated sends the preflight advisory informs the SENDER. This detector
 * only surfaces the observation.
 *
 * Hard requirements (r2 convergence):
 * - ReDoS-safe: linear, non-backtracking patterns; bounded segment count
 *   and length; an indexOf prescreen so the regex only runs when a path is
 *   plausibly present.
 * - Never matches inside an `http(s)://` URL — URLs containing paths are
 *   the legitimate form to preserve.
 * - Bounded match echo: the returned match is the regex token (whose char
 *   class already stops at whitespace/quote/`?`/`#`/`)`), truncated to
 *   120 chars, so a secret adjacent to a path can never ride into
 *   logs/advisories/transcripts.
 * - Callers wrap every call fail-OPEN: a throw skips the signal, never
 *   withholds a message and never 500s a route.
 */
export interface RawFilePathResult {
    detected: boolean;
    /** First offending path, bounded to 120 chars — safe to echo in advisories/audits. */
    match?: string;
}
export declare function detectRawFilePath(text: string): RawFilePathResult;
//# sourceMappingURL=raw-file-path.d.ts.map