/**
 * Agentic QE v3 - MCP Security Module
 * Security features for MCP tools per ADR-012
 *
 * Components:
 * - JSON Schema Validator: Validate all MCP tool inputs
 * - Rate Limiter: Token bucket algorithm (100 req/s, 200 burst)
 * - OAuth 2.1 Provider: OAuth 2.1 + PKCE for enterprise authentication
 * - Sampling Server: Server-initiated LLM for AI-driven decisions
 * - CVE Prevention: Path traversal, ReDoS, timing-safe comparison
 */
export { SchemaValidator, createSchemaValidator, createStrictSchemaValidator, getSchemaValidator, CommonSchemas, } from './schema-validator';
export type { JSONSchema, JSONSchemaType, JSONSchemaFormat, ValidationError, ValidationResult, FormatValidator, SchemaValidatorConfig, } from './schema-validator';
export { RateLimiter, SlidingWindowRateLimiter, createRateLimiter, createStrictRateLimiter, createSlidingWindowLimiter, getRateLimiter, resetDefaultRateLimiter, } from './rate-limiter';
export type { RateLimiterConfig, TokenBucket, RateLimitResult, RateLimitHeaders, RateLimiterStats, EndpointRateLimit, } from './rate-limiter';
export { OAuth21Provider, createOAuth21Provider, getOAuth21Provider, } from './oauth21-provider';
export type { OAuth21GrantType, TokenType, PKCEMethod, OAuth21Client, AuthorizationRequest, AuthorizationCode, TokenRequest, TokenResponse, TokenData, TokenIntrospection, OAuthError, OAuthErrorCode, OAuth21ProviderConfig, } from './oauth21-provider';
export { SamplingServer, createSamplingServer, getSamplingServer, QEDecisionPrompts, } from './sampling-server';
export type { SamplingRequest, SamplingMessage, SamplingContent, SamplingResponse, TokenUsage, SamplingHandler, SamplingServerConfig, SamplingServerStats, } from './sampling-server';
export { validatePath, normalizePath, joinPaths, getExtension, isRegexSafe, escapeRegex, createSafeRegex, timingSafeCompare, timingSafeHashCompare, generateSecureToken, secureHash, sanitizeInput, escapeHtml, stripHtmlTags, validateCommand, escapeShellArg, CVEPrevention, } from './cve-prevention';
export type { PathValidationResult, PathValidationOptions, RegexSafetyResult, CommandValidationResult, SanitizationOptions, } from './cve-prevention';
import { type JSONSchema } from './schema-validator';
import { type RateLimiterConfig } from './rate-limiter';
import { type OAuth21ProviderConfig } from './oauth21-provider';
/**
 * Security middleware configuration
 */
export interface SecurityMiddlewareConfig {
    enableSchemaValidation?: boolean;
    enableRateLimiting?: boolean;
    enableOAuth?: boolean;
    enableCVEPrevention?: boolean;
    rateLimiter?: Partial<RateLimiterConfig>;
    oauth?: Partial<OAuth21ProviderConfig>;
}
/**
 * Security context for tool invocation
 */
export interface SecurityContext {
    clientId?: string;
    userId?: string;
    scopes?: string[];
    token?: string;
    endpoint?: string;
    ip?: string;
}
/**
 * Security middleware result
 */
export interface SecurityCheckResult {
    allowed: boolean;
    errors: string[];
    warnings: string[];
    context?: SecurityContext;
}
/**
 * Create security middleware for MCP tools
 */
export declare function createSecurityMiddleware(config?: SecurityMiddlewareConfig): {
    /**
     * Validate tool input against schema
     */
    validateInput<T>(input: unknown, schema: JSONSchema): {
        valid: true;
        data: T;
    } | {
        valid: false;
        errors: string[];
    };
    /**
     * Check rate limit
     */
    checkRateLimit(clientId?: string, endpoint?: string): import("./rate-limiter").RateLimitResult | {
        allowed: boolean;
        remaining: number;
        headers: any;
    };
    /**
     * Validate OAuth token
     */
    validateToken(token: string): {
        valid: true;
        data: import("./oauth21-provider").TokenData;
    } | {
        valid: false;
        error: string;
    } | {
        valid: boolean;
        data: null;
    };
    /**
     * Validate file path for security
     */
    validateFilePath(path: string, basePath?: string): import("./cve-prevention").PathValidationResult;
    /**
     * Sanitize user input
     */
    sanitize(input: string): string;
    /**
     * Validate command for execution
     */
    validateShellCommand(command: string, allowedCommands?: string[]): import("./cve-prevention").CommandValidationResult;
    /**
     * Run all security checks
     */
    runSecurityChecks(context: SecurityContext, input?: unknown, schema?: JSONSchema): Promise<SecurityCheckResult>;
    /**
     * Dispose all security resources
     */
    dispose(): void;
};
/**
 * Get the default security middleware
 */
export declare function getSecurityMiddleware(): ReturnType<typeof createSecurityMiddleware>;
//# sourceMappingURL=index.d.ts.map