import type { RequestContext } from '../../utils/internal/requestContext.js';
import type { ListOptions, StorageOptions } from './IStorageProvider.js';
/**
 * Validates a tenant ID for storage operations.
 *
 * Security constraints:
 * - Must be non-empty string
 * - Maximum length: 128 characters
 * - Allowed characters: alphanumeric, hyphens, underscores, dots
 * - Cannot contain slashes or path traversal sequences
 * - Cannot start or end with special characters
 *
 * @param tenantId The tenant ID to validate.
 * @param context The request context for error reporting.
 * @throws {McpError} JsonRpcErrorCode.InvalidParams - If tenant ID is not a string, empty, too long, contains invalid characters, or has path traversal sequences.
 */
export declare function validateTenantId(tenantId: string, context: RequestContext): void;
/**
 * Validates a storage key.
 * @param key The key to validate.
 * @param context The request context for error reporting.
 * @throws {McpError} JsonRpcErrorCode.ValidationError - If key is not a non-empty string, too long, contains invalid characters, or has path traversal sequences.
 */
export declare function validateKey(key: string, context: RequestContext): void;
/**
 * Validates a prefix for list operations.
 *
 * Security constraints:
 * - Can be empty string (matches all keys within tenant)
 * - Maximum length: 512 characters
 * - No path traversal sequences allowed
 * - Only valid path characters allowed
 *
 * @param prefix The prefix to validate (empty string is valid).
 * @param context The request context for error reporting.
 * @throws {McpError} JsonRpcErrorCode.ValidationError - If prefix is not a string, too long, contains invalid characters, or has path traversal sequences.
 */
export declare function validatePrefix(prefix: string, context: RequestContext): void;
/**
 * Validates storage options.
 * @param options The storage options to validate.
 * @param context The request context for error reporting.
 * @throws {McpError} JsonRpcErrorCode.ValidationError - If TTL is not a number, negative, or not finite.
 */
export declare function validateStorageOptions(options: StorageOptions | undefined, context: RequestContext): void;
/**
 * Validates list operation options.
 *
 * Security constraints:
 * - Limit must be positive integer between 1 and 10000
 * - Cursor must be valid base64 string if provided
 * - Prevents memory exhaustion via oversized page requests
 *
 * @param options The list options to validate.
 * @param context The request context for error reporting.
 * @throws {McpError} If the options are invalid.
 */
export declare function validateListOptions(options: ListOptions | undefined, context: RequestContext): void;
/**
 * Encodes pagination cursor data into an opaque, HMAC-signed string.
 * @param lastKey The last key from the current page.
 * @param tenantId The tenant ID for validation.
 * @returns An opaque cursor string in the format `payload.signature`.
 */
export declare function encodeCursor(lastKey: string, tenantId: string): string;
/**
 * Decodes and validates an opaque, HMAC-signed cursor string.
 * @param cursor The cursor string to decode.
 * @param tenantId The expected tenant ID for validation.
 * @param context The request context for error reporting.
 * @returns The last key from the cursor.
 * @throws {McpError} If the cursor is invalid, tampered with, or has a bad signature.
 */
export declare function decodeCursor(cursor: string, tenantId: string, context: RequestContext): string;
//# sourceMappingURL=storageValidation.d.ts.map