/**
 * Path safety validation for sandbox isolation.
 *
 * Prevents path traversal to sensitive directories and detects symlink escape attempts.
 * Aligned with OpenClaw's validate-sandbox-security.ts blocked-path approach.
 */
import type { PathValidationResult } from './types.js';
/**
 * Validate that a path does not escape into blocked system/credential directories.
 *
 * The check runs in two passes:
 *  1. Lexical: normalize the path and check against blocked prefixes.
 *  2. Canonical: resolve symlinks (or deepest existing ancestor) and re-check.
 *
 * When `allowedRoots` are provided, the path must additionally be inside at
 * least one of them (after canonical resolution).
 */
export declare function validatePath(rawPath: string, options?: {
    allowedRoots?: string[];
    extraBlockedPaths?: string[];
}): PathValidationResult;
/**
 * Validate a path specifically for file write/edit operations.
 * Adds protection for config files and profile system files.
 */
export declare function validateWritePath(rawPath: string, workspaceRoot: string, options?: {
    allowedRoots?: string[];
    extraBlockedPaths?: string[];
}): PathValidationResult;