/**
 * memory-journal-mcp - Code Mode Security
 *
 * Security validation for sandboxed code execution.
 * Enforces code length limits, blocked patterns, rate limiting,
 * and result size caps.
 */
import { type SecurityConfig, type ValidationResult } from './types.js';
/**
 * Single-pass lexical scanner that strips JS comments and string literal contents
 * in a single left-to-right pass while preserving:
 * 1. `${...}` template literal interpolation expressions (so blocked patterns inside
 *    `${...}` cannot evade static scanning)
 * 2. String literals whose exact content is `constructor`, `__proto__`, or `prototype`
 *    (so bracket-notation access checks like `['constructor']` remain detectable)
 * 3. Comment markers inside string literals (preventing `"/*"` ... `"*" + "/"` or `"//"`
 *    comment-stripping desynchronization bypasses)
 */
export declare function stripCommentsAndStrings(rawCode: string): string;
/**
 * Validates user-submitted code against security policies before execution.
 */
export declare class CodeModeSecurityManager {
    private readonly config;
    private readonly rateLimits;
    private readonly cleanupInterval;
    constructor(config?: Partial<SecurityConfig>);
    /**
     * Stop the cleanup interval to prevent memory leaks when this manager is evicted.
     */
    dispose(): void;
    /**
     * Validate code against all security policies.
     * Returns a ValidationResult with any violations found.
     */
    validateCode(code: string): ValidationResult;
    /**
     * Check if a client has exceeded the rate limit.
     * Returns true if the execution is allowed.
     */
    checkRateLimit(clientId: string): boolean;
    /**
     * Clean up expired rate limit entries.
     * Should be called periodically to prevent memory leaks.
     */
    cleanupRateLimits(): void;
    /**
     * Validate that a result does not exceed size limits.
     */
    validateResultSize(result: unknown): ValidationResult;
    /** Get the current security configuration */
    getConfig(): Readonly<SecurityConfig>;
}
//# sourceMappingURL=security.d.ts.map