/**
 * Resolve a caller-supplied path against a trusted root directory and guarantee
 * the result stays inside that root. Returns the resolved absolute path, or
 * `null` if the input escapes the root — whether via `..` traversal segments or
 * an absolute path that points elsewhere.
 *
 * Use this for any request-body value that becomes a filesystem path, so that
 * untrusted callers cannot read, write, delete, or exfiltrate files outside the
 * configured data directory.
 */
export declare function resolveWithinRoot(root: string, userPath: string): string | null;
//# sourceMappingURL=path-safety.d.ts.map