import type { CommandResult } from './types';
export declare const BLOCKED_COMMAND_PATTERNS: RegExp[];
export declare const BLOCKED_PATH_PREFIXES: string[];
export declare const ALLOWED_SIGNALS: ReadonlySet<string>;
export declare const SAFE_ENV_KEYS: readonly string[];
export declare function getSensitiveHomePaths(): string[];
export declare function buildSafeEnv(): Record<string, string>;
export declare function validateCommand(command: string): string | null;
/**
 * Pure predicate variant of `assertProjectCodeIsSafe`. Use this when you
 * only need a yes/no answer (e.g. pre-pass filters) without paying the
 * i18n + Error construction cost the assert variant incurs on every
 * rejected input.
 */
export declare function isProjectCodeSafe(projectCode: string): boolean;
/**
 * Reject projectCodes / tenantCodes whose characters would break the
 * `AI_SUPPORT_AGENT_PROJECT_DIR_MAP` env format.
 *
 * The env value uses `;` as entry separator and `=` as key/value separator;
 * a code containing either would silently truncate the map and let
 * `resolveProjectDir()` fall back to the default template, silently
 * re-introducing the doubly-nested layout the recent fixes prevent.
 * Allow `[A-Za-z0-9_-]` only — matching the naming convention
 * (UPPER_SNAKE_CASE for project, lower_snake_case for tenant).
 *
 * Lives in `security.ts` (not `cli/service/wrapper-helpers.ts`) because
 * it's called by both the install path (cli/service/*) AND the docker
 * supervisor path (docker/volume-mount-builder.ts). Keeping it here
 * avoids a layering inversion where `docker/*` reaches into `cli/*`.
 */
export declare function assertProjectCodeIsSafe(projectCode: string): void;
/**
 * Synchronous variant of `validateFilePath`'s blocked-prefix check, for use
 * at script-generation / install time where async fs APIs aren't available.
 * Resolves the path via `realpathSync` when possible (falls back to the raw
 * path) and reports a blocking prefix if any. Returns `null` when the path
 * is OK to bind-mount into a container.
 */
export declare function validateBindMountPathSync(hostPath: string): string | null;
export declare function validateFilePath(filePath: string, baseDir?: string): Promise<string | null>;
export declare function resolveAndValidatePath(payload: {
    path?: unknown;
}, defaultPath?: string, baseDir?: string): Promise<string | CommandResult>;
//# sourceMappingURL=security.d.ts.map