/**
 * Validate an account name before it is ever used to build a filesystem path.
 * Account names become folder names under the profiles dir, so a name with
 * separators or `..` would escape the sandbox (and later feed `rmSync --purge`).
 * We reject rather than sanitize: only a conservative charset is allowed.
 */
export declare function assertProfileName(name: string): void;
/** True when `child` resolves to a path strictly inside `parent`. */
export declare function isInside(parent: string, child: string): boolean;
/**
 * Assert a directory is strictly inside the profiles root. Used before any
 * destructive operation (recursive delete) so a stray `--dir` or crafted
 * registry entry can never target a path outside the tool's own tree.
 */
export declare function assertInsideProfiles(profilesRoot: string, dir: string): void;