/**
 * Resolve which directories the built-in file tools may touch for a request.
 *
 * Precedence follows the credential pattern: per-call beats instance, and
 * instance beats the `NEUROLINK_TOOL_ROOTS` environment variable. The
 * instance list (or the environment, or the working directory) is a
 * ceiling — per-call roots may only narrow it, so a server that forwards
 * caller options cannot be talked into widening file access.
 *
 * Every root is resolved through realpath once, here, so a root reached
 * through a symlink (`/home/user` → `/home/agent`) admits its own files, and
 * a later `chdir` cannot move the boundary mid-request.
 *
 * @module utils/fileToolRoots
 */
import type { FileToolRootPolicy } from "../types/index.js";
/**
 * The file-tool root policy for one request.
 *
 * Returns `{ roots: null }` when nothing is configured anywhere, which keeps
 * the historical behaviour: the working directory, read at call time.
 *
 * @throws when a root does not exist, is not a directory, or a per-call root
 *   lies outside the instance ceiling. Callers invoke this before any model
 *   request so a misconfiguration fails fast.
 */
export declare function resolveFileToolRootPolicy(input: {
    perCall?: readonly string[];
    instance?: readonly string[];
}): FileToolRootPolicy;
/** Attach a resolved policy to `target` (an options bag or execution context). */
export declare function bindFileToolRoots<T extends object>(target: T, policy: FileToolRootPolicy): T;
/** The policy bound by {@link bindFileToolRoots}, if any. */
export declare function boundFileToolRoots(source: unknown): FileToolRootPolicy | undefined;