/**
 * tiny glob→RegExp: `**\/` matches zero-or-more leading directories (so
 * `**\/*.md` matches both `README.md` and `docs/README.md`, standard glob
 * semantics), bare `**` matches any depth, `*` matches one path segment.
 */
export declare function globToRegExp(glob: string): RegExp;
/** webAllow entry matcher. `*` allows any host (the intuitive "no
 *  restriction" value); `*.example.com` matches the bare domain and every
 *  subdomain; anything else is an exact host or subdomain suffix match. */
export declare function webDomainMatches(pattern: string, host: string): boolean;
export declare const uniq: (xs: string[]) => string[];
/** #303: is `target` equal to, or nested under, `container`? Both must
 *  already be `realPath()`-resolved — this is a plain string comparison, not
 *  a filesystem check, so a symlink escape must be resolved before this
 *  runs, never lexically. #496: with a `fold` other than `exact` the paths
 *  compare segment by segment through normalizeSegment. */
export declare function isWithin(container: string, target: string, fold?: SegmentFold): boolean;
/**
 * #496: is `target` inside the granted `container`? Both realPath()-resolved,
 * so every EXISTING part of either is already in its on-disk spelling
 * (realpathSync.native) and compares exactly: a grant never folds its way
 * into a differently-cased directory that really exists. Only with `fold`
 * `case` (pathFolds().allow: darwin/win32, where the probe shows the
 * filesystem folds case) do the not-yet-existing segments of `target`
 * compare case-insensitively, since they will be created on that filesystem.
 */
export declare function grantWithin(container: string, target: string, fold?: SegmentFold, platform?: NodeJS.Platform): boolean;
/** The nearest ancestor of `p` (or `p` itself) that exists. */
export declare function existingAncestor(p: string): string;
/** realpath of `p`, resolving through the nearest EXISTING ancestor when the
 *  target itself doesn't exist yet (a Write into a symlinked directory), and
 *  falling back to the lexical path when nothing on it exists. `.native`
 *  (#498): it returns the on-disk spelling of every existing part — the case
 *  on a case-insensitive filesystem, the long form of a Windows 8.3 name.
 *  A dangling symlink is followed to where a write through it would land. */
export declare function realPath(p: string): string;
/**
 * #496: how path segments compare.
 *   - `exact`: as written — a case-sensitive filesystem.
 *   - `case`: lower-cased — the default on darwin and win32, and for a
 *     GRANT's not-yet-existing segments where the filesystem folds case
 *     (grantWithin).
 *   - `deny`: for every DENY check, on every platform: NFKC-normalized and
 *     fully case-folded (lower, upper, lower again, so `ſ`, `ß`/`ẞ`, `ı`,
 *     the Kelvin sign and ligatures such as `fi` meet their ASCII forms), with
 *     trailing dots and spaces and a `:stream` suffix dropped as Windows,
 *     vfat and exfat drop them. It over-folds on purpose: a deny may refuse
 *     a look-alike, it must never miss the real file.
 */
export type SegmentFold = 'exact' | 'case' | 'deny';
/**
 * #496: the folds for the checks on one resolved path. Deny checks always
 * use `deny`, on every platform: a filesystem probe can be wrong (the
 * casefold flag of a Linux directory governs its entries, not its own name;
 * a mount root has no parent to compare), so it never relaxes a deny.
 * Grants fold (see grantWithin) only on darwin and win32, and only where
 * fs-case.ts's probe shows the filesystem folds case; on Linux they never
 * fold.
 */
export declare function pathFolds(real: string, platform?: NodeJS.Platform): {
    deny: SegmentFold;
    allow: SegmentFold;
};
/**
 * #498: the spelling of one path segment as the filesystem compares it,
 * folded as `fold` says (#496; by default case-folded on darwin and win32,
 * which are case-insensitive by default). On win32 a trailing run of dots
 * and spaces and an alternate-data-stream suffix (`bus.jsonl::$DATA`,
 * `x.json:s`) are dropped too, as Windows drops them when it opens the file.
 * A drive segment (`C:`) keeps its colon. Compare segments only after
 * `realPath()`, which already turned any existing part into its on-disk
 * spelling.
 */
export declare function normalizeSegment(seg: string, platform?: NodeJS.Platform, fold?: SegmentFold): string;
/** The normalized segments of an absolute path (see normalizeSegment), with
 *  `.` and `..` collapsed lexically, as `path.resolve()` would. Only a
 *  segment WRITTEN as `.` or `..` is one: a name that folds to `..`
 *  (fullwidth `．．` under NFKC) is an ordinary name on disk. */
export declare function pathSegments(p: string, platform?: NodeJS.Platform, fold?: SegmentFold): string[];
/** The normalized segments of `target` below `base`, or null when `target`
 *  is not under it (`[]` when they are the same path). Both absolute. */
export declare function segmentsBelow(base: string, target: string, platform?: NodeJS.Platform, fold?: SegmentFold): string[] | null;
/**
 * #258: a file-tool write into a `.git` dir that `policy.git` forbids, as the
 * `.git/...` path to name in the denial, or null when it is allowed. `real`
 * is the resolved target; segments compare case-insensitively where the
 * filesystem does (#498, #496: pass `pathFolds(real).deny`), so
 * `.GIT/Config` is `.git/config` on darwin.
 */
export declare function gitWriteViolation(real: string, gitLevel: string, platform?: NodeJS.Platform, fold?: SegmentFold): string | null;
export declare function safeHost(url: string): string | null;
//# sourceMappingURL=policy-paths.d.ts.map