/**
 * Validate that a path is safe to access within permissible roots.
 * Throws strict errors for violations.
 *
 * @param userPath - The input path from the user/agent (relative or absolute)
 * @param allowedRoots - Array of absolute paths permissible for access
 * @param cwd - Current working directory for resolving relative paths
 * @returns The normalized, validated absolute path.
 */
export declare function validatePath(userPath: string, allowedRoots: string[], cwd: string): string;
/**
 * Sanitize input to reject suspicious patterns immediately.
 * @param input - The input string to sanitize.
 * @returns The sanitized input string.
 */
export declare function sanitizeInput(input: string): string;
//# sourceMappingURL=security.d.ts.map