/**
 * Canonicalize `target` by `realpath`-resolving its longest EXISTING ancestor and
 * re-appending the not-yet-created tail. A plain `realpathSync(target)` throws when
 * `target` (a fresh output dir, a not-yet-written file) does not exist — but any
 * symlink in the part that DOES exist (the target itself, or an ancestor) is
 * exactly the escape hatch a containment check must resolve before comparing.
 * Unlike `path.resolve` (which only normalizes `..`), this follows links.
 */
export declare function realpathExistingPrefix(target: string): string;
/**
 * True when `name` is a safe single path segment: non-empty, not '.'/'..',
 * free of path separators and null bytes, and within the filename length limit.
 * Dot-prefixed names like '.env.example' are allowed.
 */
export declare function isSafeSegmentName(name: string): boolean;
/**
 * Resolve base + name while preventing path-traversal attacks.
 * Rejects path separators, null bytes, '.' and '..', and any resolved path
 * that escapes the base directory. Dot-prefixed names like '.env.example'
 * are allowed — actual traversal is caught by the containment check below.
 * Allows spaces, unicode, and other common filename characters.
 */
export declare function safeJoin(base: string, name: string): string;
/**
 * Assert that `target` (which may legitimately contain path separators, e.g. a
 * multi-segment relative key) stays within `root` after normalization. Use this
 * where a caller must accept nested relative paths but the input is untrusted —
 * `safeJoin` is stricter and only allows single segments.
 */
export declare function assertWithin(root: string, target: string): string;
