import path from "path";
function sanitizeStorageRelativePath(storagePath) {
  return String(storagePath ?? "").split(/[\\/]+/).filter((segment) => segment.length > 0 && segment !== "." && segment !== "..").join(path.sep);
}
function resolveContainedPath(joinRoot, storagePath, containmentRoot) {
  const base = path.resolve(joinRoot);
  const boundary = path.resolve(containmentRoot ?? joinRoot);
  const candidate = path.resolve(base, sanitizeStorageRelativePath(storagePath));
  const relativeToBoundary = path.relative(boundary, candidate);
  if (relativeToBoundary.startsWith("..") || path.isAbsolute(relativeToBoundary)) {
    throw new Error("[internal] attachment storage path escapes its containment root");
  }
  return candidate;
}
function resolveLegacyPublicRoot() {
  return path.join(process.cwd(), "public");
}
export {
  resolveContainedPath,
  resolveLegacyPublicRoot,
  sanitizeStorageRelativePath
};
//# sourceMappingURL=pathContainment.js.map
