/**
 * Path sandboxing utilities for preventing directory traversal attacks.
 * All filesystem operations must validate paths through these functions.
 */
/**
 * Validates that a resolved path stays within the project root.
 * Resolves symlinks to prevent symlink-based escapes.
 * Throws AppError with OUTSIDE_PROJECT_ROOT if path escapes.
 *
 * @param projectRoot - Absolute path to the project root directory
 * @param relativePath - Relative path within the project
 * @returns The resolved absolute path
 */
export declare function validateProjectPath(projectRoot: string, relativePath: string): Promise<string>;
/**
 * Validates a path for writing (target may not exist yet).
 * Checks the normalized path stays within the project root.
 *
 * @param projectRoot - Absolute path to the project root directory
 * @param relativePath - Relative path within the project
 * @returns The normalized absolute path
 */
export declare function validateParentPath(projectRoot: string, relativePath: string): Promise<string>;
//# sourceMappingURL=path-sandbox.d.ts.map