export interface ISafePathResult {
    /** Resolved absolute path. */
    absolutePath: string;
    /** Relative path from projectRoot to absolutePath. */
    relativePath: string;
}
export declare class UnsafeTargetPathError extends Error {
    readonly code: 'absolute-path-rejected' | 'traversal-detected' | 'outside-project-root' | 'empty-path';
    readonly rawPath: string;
    constructor(code: UnsafeTargetPathError['code'], rawPath: string, message: string);
}
/**
 * True when `absPath` — although it may be lexically inside `projectRoot` —
 * physically resolves (through one or more symlinks) to a location outside
 * the project root. This is the realpath-aware companion to the lexical
 * containment check and the only guard that catches an in-root symlink that
 * escapes the sandbox.
 *
 * Conservatively returns `false` when containment cannot be determined from
 * the filesystem (e.g. the project root does not exist on disk), so the
 * caller's lexical check remains authoritative in that case.
 */
export declare function pathEscapesRootViaSymlink(projectRoot: string, absPath: string): boolean;
/**
 * Resolve a template-supplied target path against the project root, refusing
 * anything that escapes the project boundary.
 *
 * Rules (in order):
 *   1. Empty / non-string input → reject.
 *   2. Absolute paths → reject unless `allowAbsolute: true`.
 *   3. Normalize the path (collapses ../ and ./).
 *   4. The resolved path must be inside (or equal to) projectRoot.
 *
 * This is the single chokepoint for all generator file writes.
 */
export declare function safeResolveTargetPath(rawPath: string, projectRoot: string, options?: {
    allowAbsolute?: boolean;
}): ISafePathResult;
/** True if a string contains `..` segments. Used for early diagnostics. */
export declare function containsTraversal(rawPath: string): boolean;
//# sourceMappingURL=safe-target-path.d.ts.map