/**
 * Input validation for MCP tool boundaries (path confinement, size limits, control characters).
 * See SECURITY.md and GitHub issue #74.
 */
/** Max UTF-16 code units for indexed text or search query. */
export declare const MAX_TEXT_CHARS: number;
export declare const MAX_METADATA_CHARS: number;
export declare const MAX_FILE_BYTES: number;
export declare const CHUNK_SIZE_MIN = 128;
export declare const CHUNK_SIZE_MAX: number;
export declare const TOP_K_MIN = 1;
export declare const TOP_K_MAX = 500;
/** Same extension / directory policy as the indexer (single source). */
export declare const INDEXABLE_EXTENSIONS: Set<string>;
export declare const SKIP_DIRS: Set<string>;
/**
 * Resolve a user-supplied path to a real path that must stay inside
 * `process.cwd()` or `LOGOSDB_INDEX_ROOT` (if set), after symlink resolution.
 */
export declare function resolveIndexablePath(userPath: string): string;
export interface CollectFilesOptions {
    /**
     * When true, honour `.gitignore` (root + nested + `.git/info/exclude` + global
     * excludes) **in addition to** the static `SKIP_DIRS` / hidden / extension
     * filters. If no enclosing Git working tree is found (walking up to
     * `process.cwd()` / `LOGOSDB_INDEX_ROOT`), this option is a no-op.
     * Default: `false` (callers in `index.ts` derive a default per-call).
     */
    respectGitignore?: boolean;
}
export declare function collectFilesSafe(rootDirReal: string, options?: CollectFilesOptions): string[];
export declare function assertNoDisallowedControls(s: string, label: string): void;
/**
 * Normalize `s` to NFC and validate that it contains no disallowed control or
 * bidi/invisible Unicode code points.
 *
 * NFC normalization ensures that semantically identical strings (e.g. NFC vs
 * NFD decompositions of the same character) produce the same embedding input,
 * preventing duplicate "same" content from accumulating in the DB.
 */
export declare function normalizeAndValidateUserText(s: string, label: string): string;
export declare function validateUserText(s: string, label: string): string;
export declare function validateMetadata(metadata: string | undefined): string | undefined;
export declare function clampChunkSize(raw: number, fallback: number): number;
export declare function clampTopK(raw: number): number;
export declare function readFileBoundedUtf8(filePath: string): string;
//# sourceMappingURL=security.d.ts.map