/**
 * Resolve an artifact path and verify it stays within the project root.
 *
 * Returns the canonicalized (symlink-resolved) absolute path if the target
 * stays inside `projectRoot`. Returns `null` if:
 *   - `relPath` is not a non-empty string, or contains a null byte
 *   - the project root does not exist
 *   - the resolved target escapes the project root
 *   - a symlink anywhere in the path chain (including above a missing leaf)
 *     points outside the project root
 *   - any fs error other than ENOENT/ENOTDIR surfaces during canonicalization
 *     (EACCES, ELOOP, EINVAL, …) — we fail closed rather than guess
 *
 * TOCTOU note: callers MUST use the returned absolute path for all
 * subsequent fs operations. Re-resolving `relPath` after this function
 * returns reintroduces the race window between canonicalization and use.
 */
export declare function resolveContainedArtifactPath(projectRoot: string, relPath: string): string | null;
//# sourceMappingURL=artifact-path.d.ts.map