/**
 * kosha-discovery — Security guardrails for external data.
 *
 * Centralised defences against supply-chain data injection.
 * Every external data ingestion point (HTTP responses, CLI output,
 * cache reads) MUST pass through {@link assertCleanPayload} before
 * the parsed payload is used.
 *
 * Threat catalogue:
 * - **base64**           Encoded credential exfiltration (LiteLLM incident)
 * - **credential_leak**  Leaked API keys / tokens (OpenAI, AWS, GitHub, Slack, Google, etc.)
 * - **script_injection** XSS / HTML injection via `<script>`, `javascript:`, event handlers
 * - **shell_injection**  Command injection via `$(…)`, backtick blocks, pipe/chain to shells
 * - **data_uri**         Executable data URIs (`data:text/html`, `data:application/…`)
 * - **null_byte**        Null-byte injection to bypass string validators
 * - **proto_pollution**  Prototype pollution via `__proto__` keys
 * - **hex_payload**      Long hex-encoded binary blobs (potential obfuscated payloads)
 * - **oversized_string** Unreasonably long strings for model metadata (>2048 chars)
 *
 * @module
 */
export interface ThreatHit {
    threat: string;
    path: string;
    value: string;
}
/**
 * Deep-scan a parsed JSON payload for security threats in keys and string
 * values at any nesting depth.
 *
 * @returns The first {@link ThreatHit} found, or `undefined` if clean.
 */
export declare function scanPayload(obj: unknown, path?: string, depth?: number): ThreatHit | undefined;
/**
 * Throw if the given payload contains **any** security threat — base64,
 * leaked credentials, script injection, shell injection, data URIs,
 * null bytes, prototype pollution keys, hex blobs, or oversized strings.
 *
 * @param data   - Parsed JSON payload to scan.
 * @param source - Human-readable label for error messages (e.g. "litellm", "OpenAI API").
 * @throws {Error} with the threat name and offending path.
 */
export declare function assertCleanPayload(data: unknown, source: string): void;
/** One entry dropped by {@link quarantineEntries}. */
export interface QuarantinedEntry {
    /** Top-level key that was dropped. */
    key: string;
    /** Threat name that tripped. */
    threat: string;
    /** Path of the offending value inside the dropped entry. */
    path: string;
}
/** Outcome of a per-entry quarantine pass. */
export interface QuarantineResult {
    /** Entries that scanned clean. */
    clean: Record<string, unknown>;
    /** Entries that were dropped, with the reason. */
    dropped: QuarantinedEntry[];
}
/**
 * Scan a keyed catalog entry-by-entry, dropping the entries that trip a threat
 * instead of rejecting the whole payload.
 *
 * {@link assertCleanPayload} is the right call for a payload kosha depends on
 * in full — a provider's own `/v1/models` response, a cache file it wrote. It
 * is the wrong call for the big third-party catalogs (models.dev, LiteLLM),
 * where one unusual model name from any of 200+ contributors would otherwise
 * take out every keyless fallback at once. Here, the bad entry is dropped and
 * named, and the rest of the catalog still loads.
 *
 * A feed where more than {@link MAX_QUARANTINE_RATIO} of entries trip is not
 * one bad row — that still throws.
 *
 * @throws {Error} when the payload is not a plain object, or when too much of
 *                 it is unclean to be a localized problem.
 */
export declare function quarantineEntries(data: unknown, source: string): QuarantineResult;
//# sourceMappingURL=security.d.ts.map