/**
 * Path safety for folder-sync deploys — keep writes inside the granted folder.
 * Shared rules (mirrored in extension/deployFs.js).
 */
export function assertSafeRelPath(relPath: string): string[] {
  if (typeof relPath !== 'string' || !relPath.trim()) {
    throw new Error('relativePath required');
  }
  const normalized = relPath.replace(/\\/g, '/').replace(/^\.\//, '');
  if (!normalized || normalized === '.') {
    throw new Error('relativePath required');
  }
  if (normalized.startsWith('/') || /^[a-zA-Z]:/.test(normalized)) {
    throw new Error('absolute paths rejected');
  }
  if (normalized.includes('\0')) {
    throw new Error('invalid path');
  }
  const parts = normalized.split('/');
  if (parts.some(p => !p || p === '.' || p === '..')) {
    throw new Error('path traversal rejected');
  }
  return parts;
}

export function isSafeRelPath(relPath: string): boolean {
  try {
    assertSafeRelPath(relPath);
    return true;
  } catch {
    return false;
  }
}
