/**
 * Path Guard
 * Validates file paths against an allowlist to prevent path traversal attacks.
 * Used by execute_sql_file tool to ensure LLM can only read authorized directories.
 */
export interface PathGuardOptions {
    /** Resolved allowed directories (realpath) */
    allowedDirs: string[];
    /** Current working directory for resolving relative paths */
    cwd: string;
}
/**
 * Resolve and validate a file path against allowlist.
 * Throws Error if path is invalid or outside allowed directories.
 *
 * @returns The canonical absolute path (realpath-resolved if file exists,
 *          otherwise the parent-validated absolute path so callers can create
 *          the file safely).
 */
export declare function resolveAndValidatePath(inputPath: string, allowedDirs: string[], cwd: string): string;
//# sourceMappingURL=path-guard.d.ts.map