/** Removes trailing slash from path. Separator to remove is chosen based on
 *  operating system. */
export declare function stripNativeTrailingSlash(p: string): string;
/**
 * Validates that a user-supplied path does not escape the base directory
 * via path traversal (CWE-22). Returns the resolved absolute path.
 *
 * Allows an exact base match (empty or `.` input) — use this for list/read
 * operations where referencing the root directory itself is valid. For
 * delete/write operations where you need to target an actual file, use the
 * `resolveStrictlyWithinBase` variant (currently inlined in media models).
 *
 * As a safety net, also rejects paths that still contain URL-encoded
 * traversal sequences (`%2e%2e`, `%2f`, `%5c`), catching cases where the
 * caller forgot to decode.
 *
 * @security This is the canonical implementation. Inlined copies exist in
 * the media model files for CodeQL compatibility — keep them in sync.
 *
 * @param userPath - The untrusted path from the request (must already be
 *   URI-decoded by the caller).
 * @param baseDir  - The trusted base directory the path must stay within.
 * @returns The resolved absolute path.
 * @throws {PathTraversalError} If the path escapes the base directory.
 */
export declare function assertPathWithinBase(userPath: string, baseDir: string): string;
export declare class PathTraversalError extends Error {
    constructor(attemptedPath: string);
}