/**
 * Resolve a target path and verify that it remains inside the intended base
 * directory. This is separator-aware, so sibling paths such as `/tmp/base2`
 * are not treated as children of `/tmp/base`. Existing symlinked base paths
 * and symlinked descendants under the base are rejected because writes would
 * follow them outside the lexical containment boundary. A base that does not
 * exist yet is vetted through its nearest existing ancestor: if that ancestor
 * is a symlink, the recursive mkdir/write that follows would be redirected
 * outside the intended tree, so it is rejected too (#2342).
 *
 * CONTRACT (#2344): the base's own ancestry can only be best-effort vetted
 * here — a symlink whose target pre-contains matching subdirectories is not
 * detectable without a caller-known boundary (see nearestExistingAncestorStats
 * for why walking every ancestor false-positives on system symlinks). Do NOT
 * pass user-controlled base paths directly to this function: vet them first
 * with vetOutputBase(), which contains them canonically against an anchor and
 * returns the canonical base to use here. Every current caller does this.
 */
export declare function resolvePathWithinBase(baseDir: string, ...segments: string[]): string;
/**
 * Canonical (realpath) form of a path that may not fully exist yet: the
 * deepest existing ancestor is resolved through every symlink, and the
 * not-yet-created suffix is appended unchanged. This answers "where would a
 * recursive mkdir/write on this path REALLY land?" — which per-component
 * lstat checks cannot, because lstat resolves intermediate symlinks and only
 * reports on the final component (#2344).
 */
export declare function canonicalizePath(inputPath: string): string;
/**
 * Vets a user-supplied output base for CLI writes and returns the canonical
 * path all subsequent writes should use (#2344).
 *
 * Two regimes, split by what the user lexically named:
 *
 *  - Base inside the anchor (relative outputs like the './anthropic-skills'
 *    default): the canonical base must stay inside the canonical anchor.
 *    A symlink that redirects it elsewhere — including one whose target
 *    already contains matching subdirectories, the case per-component lstat
 *    checks miss — is rejected. Comparing in canonical space means system
 *    links above the anchor (macOS /tmp -> /private/tmp) never false-positive.
 *
 *  - Base outside the anchor (explicit absolute or ../ outputs): the user
 *    named that destination, so there is no boundary to defend. Instead of
 *    guessing intent, the real destination is disclosed via `onDisclose`
 *    whenever it differs from the lexical path, and the canonical path is
 *    returned so what was vetted is what gets written.
 */
export declare function vetOutputBase(baseDir: string, options?: {
    anchor?: string;
    onDisclose?: (canonicalBase: string) => void;
}): string;
//# sourceMappingURL=pathSecurity.d.ts.map