/**
 * Resolve `rel` against `root` and return the absolute path ONLY when it is
 * contained within `root` both lexically AND after resolving symlinks. Returns
 * null when the target escapes the workspace (including via a symlink that
 * lexically lives inside it).
 *
 * @param allowRoot when false, the root itself is rejected (used for mutations).
 */
export declare function resolveWithinRoot(root: string, rel: string, allowRoot: boolean): string | null;