import { ModuleId, SecurityNonce, ModuleSecurityConfig, SecurityContext, SecurityViolation, CSPDirectives, HydrationData } from './types';
/**
 * Sanitizes HTML content to prevent XSS attacks.
 */
export declare class ContentSanitizer {
    /** Custom safe tags */
    private readonly customSafeTags;
    /** Custom safe attributes */
    private readonly customSafeAttributes;
    /**
     * Creates a new ContentSanitizer.
     * @param options - Sanitizer options
     */
    constructor(options?: {
        additionalTags?: string[];
        additionalAttributes?: string[];
    });
    /**
     * Sanitizes HTML content.
     * @param html - HTML to sanitize
     * @returns Sanitized HTML
     */
    sanitize(html: string): string;
    /**
     * Sanitizes plain text (escape HTML).
     * @param text - Text to sanitize
     * @returns Escaped text
     */
    sanitizeText(text: string): string;
    /**
     * Validates content against dangerous patterns.
     * @param content - Content to validate
     * @returns Whether content is safe
     */
    validate(content: string): boolean;
    /**
     * Sanitizes HTML using DOM parsing.
     * @param html - HTML to sanitize
     * @returns Sanitized HTML
     */
    private sanitizeWithDOM;
    /**
     * Recursively sanitizes a DOM node.
     * @param node - Node to sanitize
     */
    private sanitizeNode;
    /**
     * Sanitizes CSS style content using allowlist approach.
     *
     * SECURITY: Uses an allowlist of safe CSS properties rather than a blocklist.
     * This is significantly more secure because:
     * - Blocklists can be bypassed with encoding tricks, browser quirks, or new attack vectors
     * - Allowlists only permit known-safe properties, blocking unknown/dangerous ones by default
     *
     * Each CSS property is validated:
     * 1. Property name must be in the SAFE_CSS_PROPERTIES allowlist
     * 2. Property value must not contain dangerous patterns (url(), expression(), etc.)
     *
     * @param style - Style string to sanitize
     * @returns Sanitized style string with only safe properties
     */
    private sanitizeStyle;
    /**
     * Checks if a CSS value contains dangerous patterns.
     *
     * SECURITY: Defense-in-depth check for values that could execute code
     * or exfiltrate data, even within allowed properties.
     *
     * @param value - CSS value to check
     * @returns true if value contains dangerous patterns
     */
    private containsDangerousCSSValue;
}
/**
 * Manages Content Security Policy for modules.
 */
export declare class CSPManager {
    /** CSP directives */
    private readonly directives;
    /** Generated nonce */
    private readonly nonce;
    /**
     * Creates a new CSPManager.
     * @param directives - CSP directives
     */
    constructor(directives?: CSPDirectives);
    /**
     * Gets the current nonce.
     */
    getNonce(): SecurityNonce;
    /**
     * Generates CSP header value.
     * @returns CSP header string
     */
    generateHeader(): string;
    /**
     * Validates content against CSP directives.
     * @param type - Content type
     * @param source - Content source
     * @returns Whether content is allowed
     */
    validateSource(type: keyof CSPDirectives, source: string): boolean;
    /**
     * Applies CSP meta tag to document.
     */
    applyMetaTag(): void;
    /**
     * Checks if a source matches allowed sources.
     * @param source - Source to check
     * @param allowedSources - Allowed source patterns
     * @returns Whether source matches
     */
    private matchesSource;
}
/**
 * Validates cross-module events against security policies.
 */
export declare class EventValidator {
    /** Allowed event patterns */
    private readonly allowedPatterns;
    /** Blocked event patterns */
    private readonly blockedPatterns;
    /** Maximum message size */
    private readonly maxMessageSize;
    /**
     * Creates a new EventValidator.
     * @param config - Security configuration
     */
    constructor(config: ModuleSecurityConfig);
    /**
     * Validates an event name.
     * @param eventName - Event name to validate
     * @returns Whether event is allowed
     */
    isEventAllowed(eventName: string): boolean;
    /**
     * Validates message payload size.
     * @param payload - Message payload
     * @returns Whether size is valid
     */
    isPayloadSizeValid(payload: unknown): boolean;
    /**
     * Validates origin for cross-module messages.
     * @param sourceModuleId - Source module ID
     * @param _targetModuleId
     * @param allowedOrigins - Allowed module origins
     * @returns Whether origin is valid
     */
    isOriginValid(sourceModuleId: ModuleId, _targetModuleId: ModuleId, allowedOrigins?: ModuleId[]): boolean;
}
/**
 * Comprehensive security sandbox for module boundaries.
 * Provides CSP integration, XSS prevention, and secure communication.
 *
 * @example
 * ```typescript
 * const sandbox = new SecuritySandbox(moduleId, {
 *   csp: {
 *     'default-src': ["'self'"],
 *     'script-src': ["'self'", 'cdn.example.com'],
 *   },
 *   sanitizeHydration: true,
 * });
 *
 * // Validate content
 * const isSafe = sandbox.validateContent('<script>alert(1)</script>');
 *
 * // Sanitize content
 * const safe = sandbox.sanitize('<div onclick="evil()">Hello</div>');
 * ```
 */
export declare class SecuritySandbox {
    /** Module ID */
    private readonly moduleId;
    /** Security configuration */
    private readonly config;
    /** Content sanitizer */
    private readonly sanitizer;
    /** CSP manager */
    private readonly cspManager;
    /** Event validator */
    private readonly eventValidator;
    /** Security violations */
    private readonly violations;
    /** Violation limit before alerting */
    private readonly violationLimit;
    /**
     * Creates a new SecuritySandbox.
     * @param moduleId - Module ID
     * @param config - Security configuration
     */
    constructor(moduleId: ModuleId, config?: Partial<ModuleSecurityConfig>);
    /**
     * Validates content against security policies.
     * @param content - Content to validate
     * @returns Whether content is safe
     */
    validateContent(content: string): boolean;
    /**
     * Sanitizes content to make it safe.
     * @param content - Content to sanitize
     * @returns Sanitized content
     */
    sanitize(content: string): string;
    /**
     * Sanitizes text (escape HTML).
     * @param text - Text to sanitize
     * @returns Escaped text
     */
    sanitizeText(text: string): string;
    /**
     * Sanitizes hydration data for secure server-to-client transfer.
     * @param data - Raw hydration data
     * @returns Sanitized hydration data
     */
    sanitizeHydrationData(data: Omit<HydrationData, 'sanitized' | 'checksum'>): Promise<HydrationData>;
    /**
     * Validates hydration data integrity.
     * @param data - Hydration data to validate
     * @returns Whether data is valid
     */
    validateHydrationData(data: HydrationData): Promise<boolean>;
    /**
     * Checks if an event is allowed.
     * @param eventName - Event name
     * @returns Whether event is allowed
     */
    isEventAllowed(eventName: string): boolean;
    /**
     * Validates a cross-module message.
     * @param sourceModuleId - Source module
     * @param eventName - Event name
     * @param payload - Message payload
     * @returns Whether message is valid
     */
    validateMessage(sourceModuleId: ModuleId, eventName: string, payload: unknown): boolean;
    /**
     * Gets the current security nonce.
     */
    getNonce(): SecurityNonce;
    /**
     * Generates CSP header.
     * @returns CSP header string
     */
    generateCSPHeader(): string;
    /**
     * Validates a source against CSP.
     * @param type - Directive type
     * @param source - Source to validate
     * @returns Whether source is allowed
     */
    validateCSPSource(type: keyof CSPDirectives, source: string): boolean;
    /**
     * Reports a security violation.
     * @param violation - Violation details
     */
    reportViolation(violation: Omit<SecurityViolation, 'timestamp'>): void;
    /**
     * Gets all recorded violations.
     * @returns Array of violations
     */
    getViolations(): ReadonlyArray<SecurityViolation>;
    /**
     * Clears recorded violations.
     */
    clearViolations(): void;
    /**
     * Creates a security context for the module.
     * @returns Security context
     */
    createContext(): SecurityContext;
    /**
     * Recursively sanitizes a value.
     * @param value - Value to sanitize
     * @returns Sanitized value
     */
    private sanitizeValue;
}
/**
 * Creates a new security sandbox.
 * @param moduleId - Module ID
 * @param config - Security configuration
 * @returns Security sandbox instance
 */
export declare function createSecuritySandbox(moduleId: ModuleId, config?: Partial<ModuleSecurityConfig>): SecuritySandbox;
/**
 * Creates a strict security configuration.
 * @returns Strict security config
 */
export declare function createStrictSecurityConfig(): ModuleSecurityConfig;
/**
 * Creates a relaxed security configuration for development.
 * @returns Relaxed security config
 */
export declare function createRelaxedSecurityConfig(): ModuleSecurityConfig;