/// <reference types="node" />
/// <reference types="bun-types" />
export type SqliteJsonRow = Record<string, unknown>;
declare function getPlatformTrustedPrefixes(): string[];
/**
 * Validate a CCS_SQLITE_BIN override path.
 *
 * Security invariant: the resolved (symlink-expanded) path must start with
 * at least one trusted prefix. This prevents pointing at a binary in a
 * user-writable location such as /tmp, $HOME/.local, or a relative PATH
 * entry, which would reintroduce the PATH-hijack vector closed in #1347.
 *
 * Returns the validated path on success, or throws with an explanation.
 */
declare function validateEnvOverridePath(rawPath: string): string;
/**
 * Resolve the sqlite3 binary to use.
 *
 * Resolution order:
 * 1. CCS_SQLITE_BIN env var override (validated against trusted prefixes)
 * 2. First accessible path from the platform's hardcoded trusted list
 * 3. Throw "sqlite3 command not available"
 */
declare function resolveTrustedSqlitePath(env?: NodeJS.ProcessEnv): string;
export declare function querySqliteJson(dbPath: string, sql: string, env?: NodeJS.ProcessEnv): Promise<SqliteJsonRow[]>;
export { resolveTrustedSqlitePath, validateEnvOverridePath, getPlatformTrustedPrefixes };
//# sourceMappingURL=sqlite-cli.d.ts.map