import { z } from 'zod';
import { SecurityLevel } from './config';
export declare const SecureCommandSchema: z.ZodObject<{
    command: z.ZodString;
    args: z.ZodOptional<z.ZodAny>;
    sessionId: z.ZodOptional<z.ZodString>;
    operationType: z.ZodEnum<["command", "query", "eval", "screenshot", "logs", "window_info"]>;
}, "strip", z.ZodTypeAny, {
    command: string;
    operationType: "window_info" | "command" | "query" | "eval" | "screenshot" | "logs";
    args?: any;
    sessionId?: string | undefined;
}, {
    command: string;
    operationType: "window_info" | "command" | "query" | "eval" | "screenshot" | "logs";
    args?: any;
    sessionId?: string | undefined;
}>;
export interface ValidationResult {
    isValid: boolean;
    errors: string[];
    sanitizedInput?: any;
    riskLevel: 'low' | 'medium' | 'high' | 'critical';
}
export declare class InputValidator {
    private static securityLevel;
    static setSecurityLevel(level: SecurityLevel): void;
    static getSecurityLevel(): SecurityLevel;
    private static readonly DANGEROUS_KEYWORDS;
    /**
     * Subset of identifiers that must never appear in any eval payload, regardless
     * of the security level or `safePatterns` allowlist. Compared to the broader
     * {@link DANGEROUS_KEYWORDS} (used for non-eval command content), this list
     * intentionally excludes Node.js module names that collide with legitimate
     * web platform identifiers (`url` ↔ `document.URL`, `crypto` ↔ `window.crypto`,
     * `path` ↔ pathname helpers, etc.) so we don't reject documented safe payloads
     * while still catching the prototype-pollution / process-escape primitives that
     * Issue #9 was about.
     */
    private static readonly EVAL_CRITICAL_KEYWORDS;
    private static readonly XSS_PATTERNS;
    private static readonly INJECTION_PATTERNS;
    static validateCommand(input: unknown): ValidationResult;
    private static validateCommandContent;
    /**
     * Special validation for eval commands - validates the actual code to be executed.
     *
     * Defense-in-depth: {@link EVAL_CRITICAL_KEYWORDS} are screened on every eval
     * payload regardless of whether it matches a `safePatterns` shortcut, because
     * the generic property-access pattern (`/^[\w.[\]'"]+$/`) was previously letting
     * `process.platform`, `globalThis.foo`, `__proto__.constructor` etc. through
     * unchecked (Issue #9). The list is intentionally narrower than the broader
     * `DANGEROUS_KEYWORDS` used by `validateCommandContent`, so legitimate web
     * platform expressions like `document.URL` are not flagged. The function-call
     * / assignment / obfuscation checks are still gated by `isSafe`.
     */
    private static validateEvalContent;
    private static calculateObfuscationScore;
    private static calculateRiskLevel;
    private static sanitizeCommand;
}