/**
 * Assert that `target` resolves inside at least one of `allowedRoots`.
 *
 * Containment is checked **symlink-aware**: both `target` and each root
 * are resolved via `fs.realpath` before the prefix comparison, so a
 * symlink pointing outside an allowed root is rejected. Targets that do
 * not exist yet (e.g. the destination of a copy or write) are resolved
 * lexically against the realpath of their nearest existing ancestor.
 *
 * If `allowedRoots` is empty the function returns immediately — this is
 * the current "no restriction" semantics and is preserved on purpose
 * so that adding `assertContained` to a helper is purely additive: only
 * callers that pass an explicit `allowedPaths` get the tightened check.
 *
 * If `allowedRoots` is non-empty but every entry is an empty/whitespace
 * string, the call throws rather than silently degrading to "no
 * restriction". Otherwise a caller writing `allowedPaths: [""]` would
 * get the same wide-open behavior as `allowedPaths: []`, which we
 * explicitly do not want.
 *
 * Throws an `Error` whose message names the offending target and the
 * configured roots.
 */
export declare function assertContained(target: string, allowedRoots: string[], baseDir?: string): Promise<void>;