/**
 * Security Hardening and Input Sanitization (Core)
 *
 * Canonical location for input sanitization and security validation.
 * Self-contained with no dispatch dependencies.
 *
 * Canonical location: src/core/security/input-sanitization.ts
 * Re-exported from: src/dispatch/lib/security.ts (backward compat)
 *
 * @task T3144
 * @task T5706
 * @epic T3125
 */
/**
 * Security validation error thrown when input fails sanitization
 */
export declare class SecurityError extends Error {
    code: string;
    field?: string | undefined;
    constructor(message: string, code?: string, field?: string | undefined);
}
/**
 * Sanitize and validate a task ID
 */
export declare function sanitizeTaskId(value: unknown): string;
/**
 * Sanitize and validate a file path
 */
export declare function sanitizePath(path: string, projectRoot: string): string;
/**
 * Sanitize content string
 */
export declare function sanitizeContent(content: string, maxLength?: number): string;
/**
 * Validate that a value is in an allowed enum set
 */
export declare function validateEnum(value: string, allowed: string[], fieldName: string): string;
/**
 * Known enum values for CLEO domains
 */
export declare const VALID_DOMAINS: readonly ["tasks", "session", "orchestrate", "research", "lifecycle", "validate", "release", "system"];
export declare const VALID_GATEWAYS: readonly ["query", "mutate"];
export declare const VALID_MANIFEST_STATUSES: readonly ["completed", "partial", "blocked", "archived"];
export declare const VALID_LIFECYCLE_STAGE_STATUSES: readonly ["not_started", "in_progress", "blocked", "completed", "skipped", "failed"];
export declare const ALL_VALID_STATUSES: readonly ["pending", "active", "blocked", "done", "cancelled", "archived", "proposed", "completed", "partial", "blocked", "archived"];
export declare const VALID_PRIORITIES: readonly ["critical", "high", "medium", "low"];
/**
 * Rate limiter configuration
 */
export interface RateLimitConfig {
    maxRequests: number;
    windowMs: number;
}
/**
 * Rate limit check result
 */
export interface RateLimitResult {
    allowed: boolean;
    remaining: number;
    resetMs: number;
    limit: number;
}
/**
 * Default rate limit configurations per operation type
 */
export declare const DEFAULT_RATE_LIMITS: Record<string, RateLimitConfig>;
/**
 * In-memory sliding window rate limiter
 */
export declare class RateLimiter {
    private windows;
    private configs;
    constructor(configs?: Record<string, RateLimitConfig>);
    check(key: string): RateLimitResult;
    record(key: string): void;
    consume(key: string): RateLimitResult;
    reset(key?: string): void;
    getConfig(key: string): RateLimitConfig | undefined;
    setConfig(key: string, config: RateLimitConfig): void;
}
/**
 * Normalize a value to an array, preserving item types.
 *
 * - `undefined` / `null` → `undefined`
 * - Array input → returned as-is (items are NOT coerced; objects, numbers, etc. survive)
 * - String input → split on `separator`, trimmed, empty segments dropped (CSV expansion)
 * - Any other scalar → wrapped in a single-element array as a string (e.g. a bare number)
 *
 * String-array CSV expansion (e.g. `--labels foo,bar` → `["foo","bar"]`) is preserved.
 * Object-array params (e.g. `tasks.add-batch` `tasks: [{title,...}, ...]`) are NOT
 * String()-coerced — the previous behaviour corrupted objects to `"[object Object]"`.
 * Downstream typed validators (CORE) own per-param type enforcement.
 *
 * @task T9854
 */
export declare function ensureArray(value: unknown, separator?: string): unknown[] | undefined;
/**
 * Sanitize all params in a request before routing
 */
export declare function sanitizeParams(params: Record<string, unknown> | undefined, projectRoot?: string, context?: {
    domain?: string;
    operation?: string;
}): Record<string, unknown> | undefined;
//# sourceMappingURL=input-sanitization.d.ts.map