/**
 * Path Traversal Protection
 *
 * Centralized path validation to prevent directory traversal attacks.
 * Implements OWASP security guidelines and defense-in-depth principles.
 *
 * Features:
 * - Canonical path resolution (resolves .., symlinks)
 * - Whitelist-based validation
 * - Null byte and special character detection
 * - Cross-platform support (Windows, Unix)
 * - Multiple security levels
 *
 * @module security/path-validation
 */
export { type LexicalPathValidationOptions, PathValidationError, type PathValidationPolicyOptions, type ValidationLevel, type ValidationOptions, type ValidationResult, } from "./types.js";
export { isAbsolutePath, isWithinDirectory, joinPaths, normalizeSeparators, resolvePathSegments, } from "./normalization.js";
export { validatePathBasics } from "./rules.js";
export { getCanonicalBaseDir, getCanonicalPath, pathTraversesSymlink, validateAllowedDirs, } from "./canonical.js";
export { ValidationPresets } from "./presets.js";
import { type LexicalPathValidationOptions, type PathValidationPolicyOptions, type ValidationOptions, type ValidationResult } from "./types.js";
/**
 * Admit a path against the physical semantics of a runtime filesystem.
 *
 * A runtime adapter is mandatory: callers that only need normalized lexical
 * containment must use `validateLexicalPath` instead. `ValidationPresets`
 * provide policy fields and must be combined with the target adapter before
 * being passed here.
 */
export declare function validatePath(path: string, options: ValidationOptions): Promise<ValidationResult>;
/**
 * Validate lexical path containment without consulting a filesystem.
 *
 * This is suitable only when the backing store cannot resolve symbolic links,
 * or when the caller performs its own descriptor-relative filesystem checks.
 * Use `validatePath()` for filesystem admission.
 */
export declare function validateLexicalPath(path: string, options: LexicalPathValidationOptions): ValidationResult;
/**
 * Validate lexical path containment without consulting a filesystem.
 *
 * The legacy physical-policy fields are accepted for source compatibility but
 * do not weaken lexical containment. Filesystem admission must use
 * `validatePath()` with the target runtime adapter.
 *
 * @deprecated Use `validateLexicalPath()` and pass only lexical policy fields.
 */
export declare function validatePathSync(path: string, options: PathValidationPolicyOptions & {
    adapter?: ValidationOptions["adapter"];
}): ValidationResult;
export declare function createValidator(defaultOptions: ValidationOptions): (path: string, overrides?: Partial<ValidationOptions>) => Promise<ValidationResult>;
export declare function sanitizePathForDisplay(path: string, baseDir: string): string;
//# sourceMappingURL=index.d.ts.map