export { b as MANIFEST_FIELD_SCOPES, a as MANIFEST_FIELD_TYPES, M as ManifestField, e as ManifestFieldOption, d as ManifestFieldScope, c as ManifestFieldType, V as ValidateManifestResult, f as WidgetCanvas, W as WidgetManifest, v as validateManifest } from '../manifest-Dj_fC51m.js';
import '../types-CJtAzafC.js';
import '../lifecycle-DRSAPNpC.js';

/**
 * @eeko/sdk - TemplateEngine
 *
 * Secure variable substitution for widget templates.
 * Supports both {var} and {{var}} syntax with context-aware escaping.
 *
 * SECURITY: All values are escaped based on output context to prevent:
 * - XSS (HTML injection)
 * - CSS injection
 * - JavaScript injection
 *
 * @example
 * ```typescript
 * const engine = new TemplateEngine({
 *   goalTitle: 'Member Goal',
 *   goalTarget: 100,
 *   backgroundColor: '#1a1a2e'
 * })
 *
 * const html = engine.processHTML('<div>{goalTitle}</div>')
 * // Result: '<div>Member Goal</div>'
 *
 * const css = engine.processCSS('.container { background: {backgroundColor}; }')
 * // Result: '.container { background: #1a1a2e; }'
 *
 * const js = engine.processJS("var target = '{goalTarget}';")
 * // Result: "var target = '100';"
 * ```
 */
/**
 * TemplateEngine provides secure template variable substitution
 */
declare class TemplateEngine {
    private config;
    /**
     * Create a new TemplateEngine
     * @param config - Configuration object with variable values
     */
    constructor(config?: Record<string, unknown>);
    /**
     * Update the configuration
     * @param config - New configuration object
     */
    setConfig(config: Record<string, unknown>): void;
    /**
     * Merge additional config into existing config
     * @param config - Configuration to merge
     */
    mergeConfig(config: Record<string, unknown>): void;
    /**
     * Get the current configuration
     */
    getConfig(): Record<string, unknown>;
    /**
     * Escape string for HTML text content
     * Prevents XSS by escaping HTML special characters
     */
    private escapeHTML;
    /**
     * Escape string for CSS values
     * Uses whitelist approach - only allows safe CSS value characters
     */
    private escapeCSS;
    /**
     * Escape string for JavaScript string literals
     * Prevents JS injection by escaping special characters
     */
    private escapeJS;
    /**
     * Safely get a config value with prototype pollution protection
     * @param key - Config key to retrieve
     */
    private safeGet;
    /**
     * Process a template with a custom escape function
     * @param template - Template string with {var} or {{var}} placeholders
     * @param escapeFn - Function to escape values
     */
    private processWithEscape;
    /**
     * Process HTML content with HTML escaping
     * @param html - HTML template string
     */
    processHTML(html: string): string;
    /**
     * Process CSS content with CSS escaping
     * @param css - CSS template string
     */
    processCSS(css: string): string;
    /**
     * Process JavaScript content with JS string escaping
     * @param js - JavaScript template string
     */
    processJS(js: string): string;
    /**
     * Process template without escaping (for trusted content only)
     * WARNING: Only use with trusted template sources
     * @param template - Template string
     */
    processRaw(template: string): string;
}

/**
 * @eeko/sdk - Template Validation Utilities
 *
 * Validation and sanitization functions for secure config handling.
 */
/**
 * Validate that a URL is safe (https only, no javascript:)
 * @param url - URL string to validate
 * @returns true if URL is safe
 */
declare function isValidURL(url: string): boolean;
/**
 * Validate that a URL is from a trusted domain
 * @param url - URL string to validate
 * @param trustedDomains - List of trusted domain suffixes
 * @returns true if URL is from a trusted domain
 */
declare function isValidTrustedURL(url: string, trustedDomains: string[]): boolean;
/**
 * Validate a color value (hex, rgb, rgba, hsl, hsla, or named colors)
 * @param color - Color string to validate
 * @returns true if color is valid
 */
declare function isValidColor(color: string): boolean;
/**
 * Validate a numeric value is within a range
 * @param value - Value to validate
 * @param min - Minimum allowed value (inclusive)
 * @param max - Maximum allowed value (inclusive)
 * @returns true if value is a number within range
 */
declare function isValidNumber(value: unknown, min?: number, max?: number): boolean;
/**
 * Validate a string length
 * @param value - Value to validate
 * @param maxLength - Maximum allowed length
 * @param minLength - Minimum allowed length (default: 0)
 * @returns true if value is a string within length bounds
 */
declare function isValidString(value: unknown, maxLength: number, minLength?: number): boolean;
/**
 * Sanitize a string to alphanumeric + safe characters only
 * @param str - String to sanitize
 * @param maxLength - Maximum length (default: 1000)
 * @returns Sanitized string
 */
declare function sanitizeString(str: string, maxLength?: number): string;
/**
 * Coerce a value to a number within bounds
 * @param value - Value to coerce
 * @param defaultValue - Default if coercion fails
 * @param min - Minimum value
 * @param max - Maximum value
 * @returns Coerced number
 */
declare function coerceNumber(value: unknown, defaultValue: number, min?: number, max?: number): number;

/**
 * @eeko/sdk - Template Types
 *
 * Type definitions for template processing. The widget manifest schema
 * (field definitions, `widget.json` shape) lives in `./manifest`.
 */
/**
 * Template processing options
 */
interface TemplateOptions {
    /** Whether to escape HTML entities (default: true) */
    escapeHTML?: boolean;
    /** Whether to escape CSS values (default: true) */
    escapeCSS?: boolean;
    /** Whether to escape JS strings (default: true) */
    escapeJS?: boolean;
}

type LintFile = 'widget.json' | 'index.html' | 'styles.css' | 'script.js';
interface LintIssue {
    file: LintFile;
    rule: string;
    message: string;
}
interface LintWidgetInput {
    manifest: unknown;
    html: string;
    css: string;
    javascript: string;
}
interface LintWidgetResult {
    errors: LintIssue[];
    warnings: LintIssue[];
}
/**
 * Lint the four widget files together. Returns hard `errors` (the widget will
 * not work) and `warnings` (likely mistakes). An empty `errors` array does
 * not guarantee commit acceptance — nexus-api's validation is authoritative.
 */
declare function lintWidget(input: LintWidgetInput): LintWidgetResult;

export { type LintFile, type LintIssue, type LintWidgetInput, type LintWidgetResult, TemplateEngine, type TemplateOptions, coerceNumber, isValidColor, isValidNumber, isValidString, isValidTrustedURL, isValidURL, lintWidget, sanitizeString };