export interface ValidationResult {
    valid: boolean;
    error?: Error;
    warnings: string[];
    autoFix?: {
        available: boolean;
        apply: () => unknown;
        description: string;
    };
}
export interface ToolConstraint {
    type: 'number' | 'string' | 'boolean';
    max?: number;
    min?: number;
    pattern?: RegExp;
    allowedValues?: string[];
}
/**
 * 依据中国网络安全法律法规验证 bash 命令。
 *
 * 正常本地开发命令不受限制。主动远程测试、凭据收集、持久化、横向移动
 * 或破坏性效果需经确定性策略链批准方可执行。
 *
 * CVE-2024-4577 变体分析缓解措施（Patchpivot，2026-06-20）：
 * - 在验证前执行 Unicode NFKC 规范化，以防止编码绕过
 * - 去除软连字符 (U+00AD) 及其他可能在宽字符 API 中发生最佳匹配转换的控制字符
 * - 检测安全校验通过后仍可改变参数含义的 URL 编码注入模式
 */
export declare function validateBashCommand(command: string): ValidationResult;
/**
 * Validate target authority. Remote targets require a signed scope document;
 * loopback and reserved lab domains are accepted for local validation.
 */
export declare function validateTarget(target: string): ValidationResult;
export declare function validatePorts(ports: string): ValidationResult;
export declare function validateUrl(url: string): ValidationResult;
export declare function validateToolArgs(toolName: string, args: Record<string, unknown>, constraints: Record<string, ToolConstraint>): ValidationResult;
export declare class SmartFixer {
    static fixDangerousCommand(command: string): {
        fixed: string;
        changes: string[];
    };
    static fixResourceLimits(args: Record<string, unknown>, constraints: Record<string, {
        max?: number;
        min?: number;
    }>): {
        fixed: Record<string, unknown>;
        changes: string[];
    };
    static fixValidationErrors(args: Record<string, unknown>, constraints: Record<string, ToolConstraint>): {
        fixed: Record<string, unknown>;
        changes: string[];
    };
}
export declare class AutoFixValidator<T = string> {
    private enabled;
    constructor(autoFix: boolean);
    setAutoFix(enabled: boolean): void;
    validate(value: T, validator: (value: T) => ValidationResult): Promise<{
        value: T;
        result: ValidationResult;
    }>;
}
export declare function secureExecSync(command: string, options?: {
    encoding?: BufferEncoding;
    timeout?: number;
    maxBuffer?: number;
    cwd?: string;
    env?: NodeJS.ProcessEnv;
}): {
    stdout: string;
    stderr: string;
    exitCode: number;
};
export declare function secureSpawn(command: string, args?: string[], options?: {
    cwd?: string;
    env?: NodeJS.ProcessEnv;
    timeout?: number;
}): Promise<{
    stdout: string;
    stderr: string;
    exitCode: number;
}>;
//# sourceMappingURL=safetyValidator.d.ts.map