export declare const DEFAULT_DOWNLOAD_DIR: string;
export declare const ALLOWED_BASE_DIRS: string[];
/**
 * Resolve a path's canonical form, walking up to the deepest existing
 * ancestor so symlinks like macOS's `/tmp -> /private/tmp` are followed even
 * when the target path itself has not been created yet. The native realpath
 * also returns the on-disk spelling, where the JavaScript one keeps whatever
 * case the caller typed.
 */
export declare function canonicalize(path: string): string;
export declare function pathIsInside(target: string, base: string): boolean;
export declare function protectedDirs(): string[];
export declare function isInsideProtectedDir(path: string): boolean;
/** Checks a save directory and returns its canonical form, which is the only form callers may write to. */
export declare function validateSavePath(dir: string): string;
export declare function saveFile(dir: string, filename: string, data: Buffer, afterMkdir?: () => void): string;