/**
 * Shared locator discipline (release wave round-11): absolute, canonicalized
 * through the DEEPEST EXISTING ancestor (a nonexistent leaf under a symlinked
 * parent cannot alias a forbidden store), and CONFINED to the Claudexor-owned
 * tree — a locator inside a repository or an arbitrary user dir would put
 * credential state where git or other tools can capture it.
 *
 * The owned root FOLLOWS the v2 root (release wave round-18 #4): under
 * an explicit CLAUDEXOR_CONFIG_DIR override that override IS the complete
 * relocatable root — a hermetic/disposable run must accept profiles inside
 * it and reject the host's real ~/.claudexor (host credential state must not
 * leak into an isolated environment). Without the override, the owned tree
 * is ~/.claudexor as before.
 */
/** Canonicalize a path through its DEEPEST EXISTING ancestor (symlinks
 * resolved), re-appending the not-yet-existing remainder — so two spellings
 * of one location (e.g. /var vs /private/var on macOS) always compare equal
 * even before the leaf exists. */
export declare function normalizeThroughExistingAncestor(path: string): string;
export declare function canonicalIsolationLocator(locator: string, label: string): string;
//# sourceMappingURL=isolation-locator.d.ts.map