Function confine 

pub fn confine(
    root: &Path,
    candidate: &Path,
) -> Result<PathBuf, PathSafetyError>

Resolve an untrusted relative candidate against root, guaranteeing the result stays within root.

Interior . and .. components are normalized lexically; candidate is rejected if it is empty, absolute, or if its .. components would climb above root. The returned path is root with the normalized, confined remainder appended.

Unlike validate_component, this does not enforce name portability — it is meant for paths to existing files on the host, where the host’s own rules already applied when the file was created.

Errors

Returns PathSafetyError::Empty if candidate is empty, PathSafetyError::NotRelative if it is absolute or carries a root/prefix, or PathSafetyError::Traversal if it escapes root.