/**
 * Recursively copy `source` into `destination` without ever following a symlink that already
 * exists at a destination path. A sandboxed submission (running as a different OS user) can plant
 * such a symlink to redirect this trusted-user write outside its working directory, so every
 * pre-existing destination entry is lstat'd and unlinked (never followed) before being written.
 * Symlinks in the SOURCE are recreated as symlinks; their targets are never read.
 *
 * Merges into an existing destination directory (like `fs.cp(..., { recursive: true })`), but a
 * plain `fs.cp` follows destination symlinks nested inside directories, which this avoids.
 */
export declare function copyWithoutFollowingSymlinks(source: string, destination: string): Promise<void>;
/**
 * Create `directory` and the missing levels between it and `root`, replacing anything that is not
 * already a real directory. `fs.mkdir(..., { recursive: true })` follows a symlink it finds on the
 * way, which a submission can plant to place a trusted-user write outside the tree; this walks the
 * levels one at a time instead. Only levels BELOW `root` are inspected, so an unrelated symlink
 * above the caller's tree (`/tmp` on macOS, for instance) is never touched. `root` must already be
 * a directory the harness trusts, and `directory` must be inside it.
 */
export declare function createDirectoryWithoutFollowingSymlinks(root: string, directory: string): Promise<void>;
/**
 * Write `data` to `filePath` without following a symlink already there. `fs.writeFile` follows one,
 * so a sandboxed submission could point a file the harness is about to write (a generated project
 * file, a fixture) at something only the harness can reach and have it overwritten. Trusted
 * callbacks that create files inside a submission directory must use this instead.
 */
export declare function writeFileWithoutFollowingSymlinks(filePath: string, data: string | Uint8Array): Promise<void>;
/** Whether `realTargetPath` is `realDirectoryPath` itself or below it. Both must be realpaths. */
export declare function isContainedPath(realDirectoryPath: string, realTargetPath: string): boolean;