/**
 * The absolute path of `name` as a direct child of `root`, or null when
 * `name` is anything other than one plain path segment — separators, ".",
 * "..", absolute paths, or anything else that could resolve outside `root`.
 * (Extracted from the generated-dir retention policy, which relies on it to
 * refuse deleting anything but a direct child of its own root.)
 */
export declare function childPath(root: string, name: string): string | null;
/**
 * Resolves `candidate` (relative to `root`, or absolute) and confirms the
 * result stays within `root`. Returns the resolved absolute path, or null if
 * it escapes — whether via a `..` climb, an absolute path, or a different
 * drive. `root` itself counts as inside.
 *
 * Containment is decided with `path.relative`: the relative path from the
 * resolved root to the resolved candidate begins with `..` (or is itself
 * absolute) exactly when the candidate lies outside the root — the standard,
 * analyzer-recognized shape for a path-traversal barrier.
 */
export declare function resolveWithinRoot(root: string, candidate: string): string | null;
/**
 * True when `p` contains an upward-traversal (`..`) path segment. Segment
 * aware: a name that merely *contains* ".." (e.g. "a..b") is not a match.
 *
 * Use as a defense-in-depth assertion on an already-resolved absolute path
 * for endpoints that legitimately accept an arbitrary absolute path (a
 * filesystem browser, an explicit "connect this directory") and so have no
 * single root to confine to. A fully resolved path never retains a `..`
 * segment, so this rejects nothing legitimate — it makes the "normalization
 * left no traversal behind" guarantee explicit and local to the sink.
 */
export declare function hasTraversalSegment(p: string): boolean;
//# sourceMappingURL=path-safety.d.ts.map