/**
 * The literal prefixes joined with their `realpath`-resolved forms. Without
 * canonicalization macOS would let `/etc` (which realpaths to `/private/etc`)
 * slip past. The literal is always kept, so a realpath failure cannot weaken
 * the policy.
 */
export declare function buildSensitivePrefixes(realpathSyncFn?: (p: string) => string): string[];
export declare function checkSensitivePath(value: string, flagName: string): string | undefined;
//# sourceMappingURL=sensitive-path.d.ts.map