/**
 * TOCTOU-hardened filesystem utilities for bundle creation
 *
 * All path operations validate against symlink injection and traversal.
 * Zero MCP SDK imports.
 */
/**
 * Assert that a path is a safe single-segment relative name.
 *
 * v1 restriction: no nested directories (single path segment only).
 * Rejects absolute paths, `..`, empty strings, multi-segment paths, names >255 chars,
 * null bytes, colons (drive letters, NTFS ADS), Windows reserved device names,
 * and trailing dots/spaces (Windows normalizes these).
 */
export declare function assertRelativePath(p: string): void;
/**
 * Validate and resolve an output path within a base directory.
 * Does NOT create the directory -- only validates and returns the resolved path.
 */
export declare function resolveOutputPath(basePath: string, relativePath: string): string;
/**
 * Create a directory under basePath with per-component symlink checks.
 * Returns the resolved path of the created directory.
 */
export declare function safeMkdir(basePath: string, relativePath: string): Promise<string>;
/**
 * Atomically move a temp directory to a final path.
 * Uses rename() which is atomic on the same filesystem.
 * Cleans up temp dir on failure.
 */
export declare function atomicWriteDir(tempDir: string, finalPath: string): Promise<void>;
/**
 * Create a temporary directory under basePath.
 * Uses a `.tmp-<uuid>` prefix to avoid collisions.
 */
export declare function createTempDir(basePath: string): Promise<string>;
//# sourceMappingURL=path-safety.d.ts.map