/**
 * Path access rules: allow-list and deny-list of profile directories.
 *
 * Rules are compared against the canonical path — `path-guard` produces it.
 */
/** Path access rules, set in the profile */
export interface PathSecurityConfig {
    /** Directories the path may not go outside of */
    allowedPaths?: string[];
    /** Directories that are closed regardless of the allow-list */
    deniedPaths?: string[];
    /** Whether to allow `..` in a path; defaults to yes */
    allowTraversal?: boolean;
    /** Path length limit; unlimited by default */
    maxPathLength?: number;
}
export interface PathValidationResult {
    valid: boolean;
    error?: string;
}
/**
 * Whether a path lies inside a directory.
 *
 * The comparison is done at the name boundary, otherwise a rule catches
 * neighbors too: denying `/root` would also deny `/rootkit`, and allowing
 * `/var/log` would let through `/var/logs-of-someone-else` — a different
 * directory with a similar name.
 */
export declare function isUnder(path: string, directory: string): boolean;
/** Judges a path against the profile's rules: allow-list, deny-list, length, `..` */
export declare class PathValidator {
    private config?;
    /** Comparison rules, normalized to the form of the path being checked */
    private readonly deniedPaths;
    private readonly allowedPaths;
    constructor(config?: PathSecurityConfig | undefined);
    /** Rejection reason or approval: the path is judged against every configured rule */
    validate(path: string): PathValidationResult;
    /** Whether there are any rules that compare a path against directories */
    private hasRules;
    /** A batch of paths: the response is the first rejection */
    validateBatch(paths: string[]): PathValidationResult;
}
/** A validator for the profile, or nothing — if the profile has no rules */
export declare function createPathValidator(sshConfig: any): PathValidator | undefined;