/**
 * Config directory management for Bedrock mode.
 *
 * Ensures the Claude config directory exists and enforces $HOME containment
 * when the path was not explicitly provided by the operator.
 */
import path from 'path';
/**
 * Returns true when `resolved` is `home` itself or a descendant of `home`.
 *
 * Uses path.relative rather than a textual prefix comparison so the check is
 * separator-agnostic. The previous implementation compared against `home + '/'`,
 * which never matched on Windows (backslash separators) and so rejected the
 * default `C:\Users\<user>\.claude-bedrock` path (Bug #1, IOPS-1306).
 *
 * @param home - The $HOME base directory (native separators)
 * @param resolved - An already-resolved absolute path (native separators)
 * @param p - Path implementation (defaults to the platform path module; pass
 *            path.win32 / path.posix to test the other platform's semantics)
 */
export declare function isInsideHome(home: string, resolved: string, p?: path.PlatformPath): boolean;
/**
 * Ensures the given config directory exists (mkdirSync recursive).
 *
 * Security invariant (when explicit === false):
 * - The resolved path must be within $HOME. Paths that resolve outside $HOME
 *   (e.g. via `..` traversal or absolute paths to /tmp) are rejected with an error.
 * - When explicit === true (operator provided --config-dir), the HOME containment
 *   guard is bypassed.
 *
 * @param dirPath - The directory path to create (may contain ~)
 * @param explicit - true when the path was explicitly provided by the operator
 * @returns The resolved absolute path that was created
 * @throws Error if the path escapes $HOME when not explicit
 */
export declare function ensureConfigDir(dirPath: string, explicit?: boolean): string;
//# sourceMappingURL=config-dir.d.ts.map