import { MemoryJournalMcpError } from '../types/errors.js';
/**
 * Base class for security-related errors.
 * Extends MemoryJournalMcpError with VALIDATION category.
 */
export declare class SecurityError extends MemoryJournalMcpError {
    constructor(message: string, code: string);
}
/**
 * Thrown when an invalid date format pattern is detected
 */
export declare class InvalidDateFormatError extends SecurityError {
    constructor(value: string);
}
/**
 * Thrown when path traversal is detected in input
 */
export declare class PathTraversalError extends SecurityError {
    constructor(path: string);
}
export type DateGroupBy = 'day' | 'week' | 'month';
/**
 * Validates and returns a safe strftime format pattern.
 *
 * @param groupBy - The grouping period ('day', 'week', or 'month')
 * @returns The validated strftime format pattern
 * @throws InvalidDateFormatError if the groupBy value is invalid
 *
 * @example
 * ```typescript
 * const format = validateDateFormatPattern('day') // Returns '%Y-%m-%d'
 * const format = validateDateFormatPattern('invalid') // Throws InvalidDateFormatError
 * ```
 */
export declare function validateDateFormatPattern(groupBy: string): string;
/**
 * Escapes special characters in LIKE patterns to prevent injection.
 * SQLite LIKE uses % and _ as wildcards.
 *
 * @param query - The user-provided search query
 * @returns Escaped query safe for use in LIKE patterns
 *
 * @example
 * ```typescript
 * sanitizeSearchQuery('100%') // Returns '100\\%'
 * sanitizeSearchQuery('test_value') // Returns 'test\\_value'
 * ```
 */
export declare function sanitizeSearchQuery(query: string): string;
/**
 * Validates that a filename does not contain path traversal characters.
 *
 * @param filename - The filename to validate
 * @throws PathTraversalError if path traversal is detected
 */
export declare function assertNoPathTraversal(filename: string): void;
/**
 * Validates that a directory path is strictly bounded within the active memory journal context.
 *
 * This enforces strict file-system isolation. The target path MUST reside within:
 * 1. The current working directory (where the server was started)
 * 2. OR any explicitly configured path inside the PROJECT_REGISTRY map.
 *
 * @param dirPath - The directory path to validate
 * @throws PathTraversalError if the path escapes the sandboxed boundaries
 */
export declare function assertSafeDirectoryPath(dirPath: string, providedRoots: string[]): void;
/**
 * Validates that a file path is strictly bounded and refuses symlinks to prevent
 * any file-level traversal tricks.
 */
export declare function assertSafeFilePath(filePath: string, providedRoots: string[]): void;
/**
 * Sanitizes an error message by replacing any detected tokens with '[REDACTED]'.
 * This is a defense-in-depth measure for error logging paths.
 *
 * @param message - The error message to sanitize
 * @returns The sanitized message with tokens replaced
 */
export declare function sanitizeErrorForLogging(message: string): string;
/**
 * Marks free-text content as untrusted remote origin for LLM instruction consumption.
 * Defends against prompt-injection by surrounding external inputs with tags.
 *
 * Will not insert nested tags if the content is already marked.
 */
export declare function markUntrustedContent(content: string | undefined | null): string;
/**
 * Utility for formatting remote content natively for inline single-line contexts.
 */
export declare function markUntrustedContentInline(content: string | undefined | null): string;
/**
 * Sanitize an author string: strip control characters and cap length.
 * Prevents crafted git config or TEAM_AUTHOR values from injecting
 * control characters into the database or JSON payloads.
 *
 * @param raw - The raw author string from git config or environment
 * @returns Sanitized string with control characters removed and length capped at 100
 */
export declare function sanitizeAuthor(raw: string): string;
/**
 * Resolve the author name strictly from the authenticated context.
 * Prioritizes authenticated claims over TEAM_AUTHOR environment variables.
 * Uses sanitizeAuthor() to strip control characters and cap length.
 */
export declare function resolveAuthenticatedAuthor(): string;
/**
 * Resolve the author name for team-shared entries.
 * Priority: TEAM_AUTHOR env → req.auth.sub → 'unknown'.
 * Uses sanitizeAuthor() to strip control characters and cap length.
 */
export declare function resolveAuthor(): string;
//# sourceMappingURL=security-utils.d.ts.map