/**************************************************
 * Canonical Path Resolution
 * @module security/path-validation/canonical
 **************************************************/
import type { RuntimeAdapter } from "../../platform/adapters/base.js";
import { type ValidationResult } from "./types.js";
export declare function getCanonicalPath(path: string, adapter: RuntimeAdapter): Promise<{
    path: string;
    isSymlink: boolean;
}>;
/**
 * Detect a terminal or intermediate symlink below a trusted lexical root.
 * The root itself is excluded: callers separately canonicalize it so a
 * deployment path such as macOS `/var` may legitimately resolve elsewhere.
 */
export declare function pathTraversesSymlink(path: string, baseDir: string, adapter: RuntimeAdapter): Promise<boolean>;
/**
 * Resolve the base directory to its physical form so that a physically-resolved
 * candidate path is compared against a physically-resolved base. Without this,
 * a base whose own path contains symlinked segments (e.g. macOS /var → /private/var
 * or a temp dir) would spuriously fail containment once the candidate is resolved
 * to its real path. Falls back to the lexical base when realPath is unavailable
 * or the base does not exist.
 */
export declare function getCanonicalBaseDir(baseDir: string, adapter: RuntimeAdapter): Promise<string>;
export declare function validateAllowedDirs(canonicalPath: string, baseDir: string, allowedDirs: string[] | undefined): ValidationResult;
//# sourceMappingURL=canonical.d.ts.map