export declare function requireSurfaceRoot(surfaceRoot: string, source?: string): string;
export declare function resolveSurfaceDirectory(baseDirectory: string, surfaceRoot: string, ...segments: string[]): string;
export declare function resolveSurfaceSharedFile(baseDirectory: string, surfaceRoot: string, extension?: string): string;
export declare function resolveSharedDirectory(baseDirectory: string, ...segments: string[]): string;
export declare function resolveScopedDirectory(baseDirectory: string, surfaceRoot: string | undefined, ...segments: string[]): string;
/**
 * Restrict an id to a safe single filename segment (no path traversal, no
 * separators). Shared by the legacy per-session recovery filenames in
 * session-persistence-scope.ts and the `SessionSurface.recoveryFile` helper in
 * session-surface.ts, so both produce byte-identical filenames for the same
 * session id.
 *
 * Collision resistance: character replacement alone is not injective, `a/b`
 * and `a_b` both flatten to `a_b`, so two different sessions would share one
 * snapshot file and silently overwrite each other. When (and only when)
 * sanitization actually changed the id, a short digest of the RAW id is
 * appended, which restores one-file-per-id. An id that is already a safe
 * segment is returned byte-for-byte unchanged, machine-minted session ids
 * (`randomBytes(4).toString('hex')`, see generateUserSessionId; agent ids
 * `agent-<8 hex>`) always take that path, so no existing on-disk filename
 * moves as a result of this rule.
 */
export declare function sanitizeSessionIdSegment(id: string, source?: string): string;
//# sourceMappingURL=surface-root.d.ts.map