/**
 * Provides sanitize mirror id for the lifecycle pipeline.
 */
export declare function sanitizeMirrorId(value: string): string;
/**
 * Provides sanitize asset id for the lifecycle pipeline.
 */
export declare function sanitizeAssetId(value: string): string;
/**
 * Removes leading and trailing "-" characters in a single linear pass.
 *
 * Equivalent to `value.replace(/^-+|-+$/gu, "")`; the regex form is flagged
 * by CodeQL as a polynomial-ReDoS risk on adversarial input, the scan is
 * not.
 */
export declare function trimDashes(value: string): string;
/**
 * Replaces each maximal run of characters for which `isAllowed` returns
 * false with a single "-" (linear, no regex backtracking).
 *
 * Equivalent to `value.replace(/[^...]+/g, "-")` for a single class, but a
 * regex with a `+` over a negated character class is flagged by CodeQL as a
 * polynomial-reDoS risk on adversarial input; a plain one-character-at-a-time
 * scan is unconditionally linear.
 */
export declare function replaceRunsWithDash(value: string, isAllowed: (character: string) => boolean): string;
/**
 * Returns whether the provided value matches path within root.
 */
export declare function isPathWithinRoot(rootPath: string, targetPath: string): boolean;
/**
 * Resolves safe mirror file path from the provided inputs.
 */
export declare function resolveSafeMirrorFilePath(rawRoot: string, relativePath: string, operation?: "read" | "write"): string;
/**
 * Resolves allowed absolute path from the provided inputs.
 */
export declare function resolveAllowedAbsolutePath(pathValue: string, allowedRoots: readonly string[]): string | null;
/**
 * Resolves allowed real file path from the provided inputs.
 */
export declare function resolveAllowedRealFilePath(pathValue: string, allowedRoots: readonly string[]): Promise<string | null>;