/**
 * The directory that holds every work's folder, resolved the SAME way the asset
 * routes resolve paths (resolveAssetPath joins `resolve(getDataDir(), "works", …)`).
 * File watchers (composition-watcher / plan-watcher) MUST use this so they never
 * diverge from the REST routes on a non-default config.
 *
 * Priority: explicit AUTOVIRAL_WORKS_ROOT → <AUTOVIRAL_DATA_DIR>/works →
 * ~/.autoviral/works. In production all three collapse to ~/.autoviral/works;
 * the divergence only bit tests / custom-DATA_DIR setups (review 2026-06-09).
 */
export declare function getWorksRoot(): string;
export declare const SAFE_ID: RegExp;
export declare const ASSET_ROOTS: readonly ["assets", "output", "plan"];
export type AssetRoot = (typeof ASSET_ROOTS)[number];
export declare class UnsafePathError extends Error {
    readonly attempted: string;
    constructor(message: string, attempted: string);
}
/**
 * Resolve a user-supplied subpath against a per-work asset root.
 * Throws UnsafePathError if the resolved path escapes the allowed root.
 *
 * @param workId  Caller-validated work id (must already pass SAFE_ID)
 * @param root    Either "assets" or "output" — anything else is rejected
 * @param userPath  Slash-or-backslash separated subpath (may contain "../" — rejected)
 */
export declare function resolveAssetPath(workId: string, root: AssetRoot, userPath: string): string;
/**
 * Same as resolveAssetPath but returns the directory that holds the file
 * (creating it on disk is the caller's responsibility).
 */
export declare function resolveAssetSubdir(workId: string, root: AssetRoot, subdir: string): string;
/**
 * Pick a file path under workDir/<root>/ given a basename only.
 * Rejects any "/" or "\" in the basename.
 */
export declare function resolveAssetFile(workId: string, root: AssetRoot, basename: string): string;
/**
 * For routes that accept BOTH a subdir AND a basename and need to combine them.
 * Rejects traversal in either piece.
 */
export declare function resolveAssetSubpath(workId: string, root: AssetRoot, subdir: string, basename: string): string;
//# sourceMappingURL=safe-paths.d.ts.map