export type HostKind = "ip" | "cidr" | "hostname";
export interface ParsedHost {
    kind: HostKind;
    value: string;
}
/**
 * Parse a network target as IP, CIDR, or hostname. Throws on shell-injection
 * attempts. The output is safe to pass to spawn() with `shell: false`.
 */
export declare function parseHost(raw: string): ParsedHost;
/**
 * Validate an nmap-compatible port specification. Accepts:
 *   - single port: "80"
 *   - csv: "80,443,8080"
 *   - ranges: "1-1000"
 *   - mixed: "22,80,443,8000-9000"
 */
export declare function parsePortSpec(raw: string): string;
export type ScanType = "syn" | "tcp" | "udp" | "ping";
export type TimingTemplate = "T0" | "T1" | "T2" | "T3" | "T4" | "T5";
export interface ScanProfile {
    scanType?: ScanType | undefined;
    topPorts?: number | undefined;
    serviceDetect?: boolean | undefined;
    scripts?: string[] | undefined;
    timing?: TimingTemplate | undefined;
    udp?: boolean | undefined;
}
/** Normalize provider/model JSON into the exact safe scan-profile contract. */
export declare function normalizeScanProfile(raw: unknown): ScanProfile | undefined;
/** True when an nmap argv contains a scan type that needs root/Administrator. */
export declare function nmapScanNeedsPrivilege(argv: readonly string[]): boolean;
/**
 * Rewrite a privileged nmap argv into an equivalent that runs WITHOUT root:
 * SYN/FIN/Xmas/etc. stealth variants become a TCP connect scan (-sT), and
 * flags that simply cannot run unprivileged (-O OS detection, -sU UDP,
 * -sO protocol) are dropped. Used as the automatic fallback when sudo /
 * elevation is declined or unavailable.
 */
export declare function toConnectScanArgv(argv: readonly string[]): string[];
/** True when argv already skips host discovery (-Pn). */
export declare function nmapArgvHasPn(argv: readonly string[]): boolean;
/**
 * Last non-flag token that looks like a single host (IP/hostname), not a
 * CIDR/range. Used to decide when -Pn is safe/default for port scans.
 */
export declare function isNmapSingleHostTarget(argv: readonly string[]): boolean;
/** Insert -Pn once near the front of argv (after any scan-type flags). */
export declare function withNmapSkipDiscovery(argv: readonly string[]): string[];
/** nmap reported success but host discovery found nothing / host "down". */
export declare function looksLikeNmapNoHostsUp(output: string): boolean;
/** Convert a structured scan profile into safe argv for nmap. */
export declare function profileToNmapArgs(rawProfile?: ScanProfile): string[];
/**
 * For backwards compatibility with the legacy `flags` string. Every token is
 * validated by NAME against {@link LEGACY_NMAP_FLAGS} and every value by
 * shape, so an unrecognized, file-writing, file-reading, or script-loading
 * flag is rejected before nmap is spawned (and before any privilege
 * escalation), in both the split (`-oN out`) and equals (`-oN=out`) forms.
 */
export declare function parseLegacyFlags(raw: string): string[];