/**
 * SMI-898: Path Traversal Protection for Database Paths
 *
 * Provides secure path validation for database and file storage paths.
 * Prevents path traversal attacks by:
 * - Canonicalizing paths with path.resolve() and path.normalize()
 * - Validating that resolved paths stay within allowed directories
 * - Rejecting paths with ".." traversal attempts
 * - Blocking absolute paths outside allowed directories
 */
/**
 * Configuration for path validation
 */
export interface PathValidationOptions {
    /** Allowed base directories for path resolution (default: [~/.skillsmith]) */
    allowedDirs?: string[];
    /** Allow in-memory database path ':memory:' (default: true) */
    allowInMemory?: boolean;
    /** Allow paths under system temp directory (default: true for testing) */
    allowTempDir?: boolean;
    /** Maximum path length (default: 4096) */
    maxLength?: number;
}
/**
 * Result of path validation
 */
export interface PathValidationResult {
    /** Whether the path is valid */
    valid: boolean;
    /** The sanitized and resolved path (if valid) */
    resolvedPath?: string;
    /** Error message (if invalid) */
    error?: string;
}
/**
 * Default allowed directories for database storage.
 *
 * Note (SMI-4577): `~/.skillsmith` covers cache artifacts at
 * `~/.skillsmith/cache/` (HNSW indexes, model metadata) via prefix match —
 * the explicit subtree is intentionally NOT a separate entry to avoid
 * duplicate matches in the prefix loop below.
 */
export declare const DEFAULT_ALLOWED_DIRS: string[];
/**
 * Validate and sanitize a database path to prevent path traversal attacks.
 *
 * Security measures:
 * 1. Rejects null bytes and control characters
 * 2. Canonicalizes path with resolve() and normalize()
 * 3. Checks for ".." traversal attempts before resolution
 * 4. Validates resolved path is within allowed directories
 * 5. Handles both absolute and relative paths
 *
 * @param inputPath - The raw path to validate
 * @param options - Validation configuration options
 * @returns Validation result with resolved path or error
 *
 * @example
 * ```typescript
 * // Valid paths
 * validateDbPath('/Users/me/.skillsmith/skills.db')
 * // => { valid: true, resolvedPath: '/Users/me/.skillsmith/skills.db' }
 *
 * validateDbPath(':memory:')
 * // => { valid: true, resolvedPath: ':memory:' }
 *
 * // Invalid paths - traversal attack
 * validateDbPath('../../../etc/passwd')
 * // => { valid: false, error: 'Path traversal detected' }
 *
 * validateDbPath('/etc/passwd')
 * // => { valid: false, error: 'Path outside allowed directories' }
 * ```
 */
export declare function validateDbPath(inputPath: string | undefined, options?: PathValidationOptions): PathValidationResult;
/**
 * Validate a database path and throw an error if invalid.
 * Convenience wrapper for validateDbPath that throws instead of returning error.
 *
 * @param inputPath - The raw path to validate
 * @param options - Validation configuration options
 * @returns The validated and resolved path
 * @throws Error if path validation fails
 *
 * @example
 * ```typescript
 * const safePath = validateDbPathOrThrow(process.env.DB_PATH);
 * // Either returns valid path or throws
 * ```
 */
export declare function validateDbPathOrThrow(inputPath: string | undefined, options?: PathValidationOptions): string;
/**
 * Check if a path is safe for database usage without modifying it.
 * Quick check that doesn't resolve the path.
 *
 * @param inputPath - The path to check
 * @returns True if the path appears safe (no obvious traversal)
 */
export declare function isPathSafe(inputPath: string): boolean;
//# sourceMappingURL=pathValidation.d.ts.map