// SPEC-094 AC-3: Path sanitizer — prevents path traversal attacks
import { resolve, normalize, relative } from 'node:path';
const MAX_PATH_LENGTH = 4096;
export class PathViolationError extends Error {
    code = 'PATH_VIOLATION';
    input;
    constructor(message, input) {
        super(message);
        this.name = 'PathViolationError';
        this.input = input;
    }
}
/**
 * Sanitizes a path ensuring it stays within projectRoot.
 * Returns a branded SafePath on success.
 *
 * Checks:
 * 1. No null bytes
 * 2. Path length <= 4096
 * 3. Resolved path does not escape projectRoot (relative check)
 */
export function sanitizePath(input, projectRoot) {
    if (input.includes('\0')) {
        throw new PathViolationError('Path contains null bytes. Remove null characters and retry.', input);
    }
    if (input.length > MAX_PATH_LENGTH) {
        throw new PathViolationError(`Path exceeds maximum length of ${MAX_PATH_LENGTH} characters. Use a shorter path.`, input);
    }
    const resolved = normalize(resolve(projectRoot, input));
    const rel = relative(projectRoot, resolved);
    if (rel.startsWith('..') || rel.startsWith('/')) {
        throw new PathViolationError(`Path "${input}" escapes project root. Use a path within the project directory.`, input);
    }
    return resolved;
}
//# sourceMappingURL=path-sanitizer.js.map