/**
 * Path security utilities for preventing path traversal attacks
 *
 * This module provides utilities to validate directory paths and prevent
 * unauthorized access to sensitive system directories.
 */
/**
 * Error thrown when a path validation check fails
 */
export declare class PathSecurityError extends Error {
    readonly code: string;
    constructor(message: string, code: string);
}
/**
 * Sensitive Unix/Linux system directories that should be denied access
 */
declare const UNIX_SENSITIVE_PATHS: string[];
/**
 * Sensitive Windows system directories that should be denied access
 */
declare const WINDOWS_SENSITIVE_PATHS: string[];
/**
 * Normalize a path for security checks
 *
 * Converts the path to an absolute path and resolves symlinks to prevent
 * bypassing security checks through symbolic links.
 *
 * @param dirPath - Path to normalize
 * @returns Normalized absolute path with symlinks resolved
 */
declare function normalizePath(dirPath: string): string;
/**
 * Check if a path starts with any of the given sensitive paths
 *
 * @param normalizedPath - Normalized absolute path to check
 * @param sensitivePaths - Array of sensitive path prefixes
 * @returns The matched sensitive path, or null if no match
 */
declare function findSensitivePathMatch(normalizedPath: string, sensitivePaths: string[]): string | null;
/**
 * Options for validateDirectoryPath
 */
export interface ValidateDirectoryPathOptions {
    /**
     * Optional whitelist of allowed workspace directories
     * If provided, the path must be within one of these directories
     */
    allowedWorkspaces?: string[];
    /**
     * Whether to check if the path exists and is a directory
     * @default false
     */
    checkExists?: boolean;
}
/**
 * Validate a directory path for security
 *
 * This function implements multiple security checks:
 * 1. Normalizes the path and resolves symlinks
 * 2. Checks against known sensitive system directories (Unix and Windows)
 * 3. Optionally validates against a workspace whitelist
 * 4. Optionally checks if the path exists and is a directory
 *
 * @param dirPath - Directory path to validate
 * @param options - Validation options
 * @throws PathSecurityError if validation fails
 * @returns The normalized absolute path if validation succeeds
 *
 * @example
 * ```typescript
 * // Basic validation
 * const safePath = validateDirectoryPath('/home/user/project');
 *
 * // With workspace whitelist
 * const safePath = validateDirectoryPath('/home/user/project', {
 *   allowedWorkspaces: ['/home/user/projects'],
 * });
 *
 * // With existence check
 * const safePath = validateDirectoryPath('/home/user/project', {
 *   checkExists: true,
 * });
 * ```
 */
export declare function validateDirectoryPath(dirPath: string, options?: ValidateDirectoryPathOptions): string;
/**
 * Check if a directory path is safe (without throwing errors)
 *
 * This is a non-throwing version of validateDirectoryPath that returns
 * a boolean indicating whether the path is safe.
 *
 * @param dirPath - Directory path to check
 * @param options - Validation options
 * @returns true if the path is safe, false otherwise
 *
 * @example
 * ```typescript
 * if (isDirectoryPathSafe('/etc')) {
 *   // Will not be executed
 * }
 *
 * if (isDirectoryPathSafe('/home/user/project')) {
 *   // Safe to proceed
 * }
 * ```
 */
export declare function isDirectoryPathSafe(dirPath: string, options?: ValidateDirectoryPathOptions): boolean;
export { UNIX_SENSITIVE_PATHS as _UNIX_SENSITIVE_PATHS, WINDOWS_SENSITIVE_PATHS as _WINDOWS_SENSITIVE_PATHS, normalizePath as _normalizePath, findSensitivePathMatch as _findSensitivePathMatch, };
//# sourceMappingURL=path-security.d.ts.map