/**
 * @module @arcis/node/core/constants
 * Named constants for Arcis - no magic numbers
 */
export declare const INPUT: {
    /** Default maximum input size (1MB) */
    readonly DEFAULT_MAX_SIZE: 1000000;
    /** Maximum recursion depth for nested objects */
    readonly MAX_RECURSION_DEPTH: 10;
};
export declare const RATE_LIMIT: {
    /** Default window size (1 minute) */
    readonly DEFAULT_WINDOW_MS: 60000;
    /** Default max requests per window */
    readonly DEFAULT_MAX_REQUESTS: 100;
    /** Default HTTP status code for rate limited responses */
    readonly DEFAULT_STATUS_CODE: 429;
    /** Default error message */
    readonly DEFAULT_MESSAGE: "Too many requests, please try again later.";
    /** Minimum window size (1 second) */
    readonly MIN_WINDOW_MS: 1000;
    /** Maximum window size (24 hours) */
    readonly MAX_WINDOW_MS: 86400000;
};
export declare const HEADERS: {
    /** Default Content Security Policy */
    readonly DEFAULT_CSP: string;
    /** Default HSTS max age (1 year in seconds) */
    readonly HSTS_MAX_AGE: 31536000;
    /** Default X-Frame-Options value */
    readonly FRAME_OPTIONS: "DENY";
    /** Default X-Content-Type-Options value */
    readonly CONTENT_TYPE_OPTIONS: "nosniff";
    /** Default Referrer-Policy value */
    readonly REFERRER_POLICY: "strict-origin-when-cross-origin";
    /** Default Permissions-Policy value */
    readonly PERMISSIONS_POLICY: "geolocation=(), microphone=(), camera=()";
    /** Default Cache-Control value for security */
    readonly CACHE_CONTROL: "no-store, no-cache, must-revalidate, proxy-revalidate";
};
/**
 * XSS patterns, compiled from the shared `patterns.json` `xss` category.
 *
 * Both detection (detectXss) and removal (sanitizeXss) iterate the same rule
 * list: the rules are precise capture patterns (full tag / attribute / protocol)
 * so they double as removal targets, and patterns.json file order keeps every
 * block rule (e.g. `<script>...</script>`) ahead of its bare-tag counterpart so
 * removal strips the larger match first. Pre-migration these were two hardcoded
 * arrays (a broad detect set + a precise remove set); single-sourcing them here
 * ends the dual-write against patterns.json and converges Node onto the same
 * detection Python + Go already ship (Pattern 2 + Pattern 7).
 */
export declare const XSS_PATTERNS: RegExp[];
/** Removal patterns for sanitizeXss(): the same patterns.json `xss` rules.
 *  A separate compiled array so its RegExp lastIndex state is independent of
 *  the detection pass. */
export declare const XSS_REMOVE_PATTERNS: RegExp[];
/** Compiled from the shared `patterns.json` `sql_injection` category. The
 *  quoted-boolean rules use RE2-safe `['"]...['"]` (no backreference) since
 *  patterns.json is also consumed by Go's RE2 engine; validated equivalent to
 *  the former backreference forms on the O'Brien / tautology corpus. */
export declare const SQL_PATTERNS: RegExp[];
/** Compiled from the shared `patterns.json` `path_traversal` category. */
export declare const PATH_PATTERNS: RegExp[];
/** Compiled from the shared `patterns.json` `command_injection` category. */
export declare const COMMAND_PATTERNS: RegExp[];
/**
 * Prototype pollution keys to block.
 * Stored lowercase — always compare with key.toLowerCase().
 *
 * Includes:
 * - __proto__: direct prototype assignment
 * - constructor: access to constructor.prototype chain
 * - prototype: direct prototype property
 * - __defineGetter__/__defineSetter__: legacy property definition (can override getters/setters)
 * - __lookupGetter__/__lookupSetter__: legacy property introspection
 */
export declare const DANGEROUS_PROTO_KEYS: Set<string>;
/** MongoDB operators to block, from `patterns.json` nosql_injection.dangerous_keys. */
export declare const NOSQL_DANGEROUS_KEYS: Set<string>;
export declare const NOSQL_STRING_PATTERN: RegExp;
/**
 * Identity/auth field names that must hold a scalar value. A field here
 * carrying an array or object is a NoSQL type-juggling operator-injection
 * shape (e.g. {"username":["admin"]}). v1.7 nosql-type-juggle.
 */
export declare const AUTH_FIELDS: Set<string>;
export declare const REDACTION: {
    /** Replacement text for redacted values */
    readonly REPLACEMENT: "[REDACTED]";
    /** Truncation indicator */
    readonly TRUNCATED: "[TRUNCATED]";
    /** Max depth indicator */
    readonly MAX_DEPTH: "[MAX_DEPTH]";
    /** Default max message length */
    readonly DEFAULT_MAX_LENGTH: 10000;
    /** Default sensitive keys to redact */
    readonly SENSITIVE_KEYS: Set<string>;
};
export declare const VALIDATION: {
    /**
     * Email regex pattern.
     * Rejects consecutive dots in local part (e.g. test..foo@example.com),
     * leading/trailing dots, and other common invalid forms.
     */
    readonly EMAIL: RegExp;
    /**
     * URL regex pattern.
     * Only allows http:// and https:// (case-insensitive scheme per
     * RFC 3986); explicitly rejects javascript:, data:, vbscript:, and
     * other dangerous URI schemes.
     */
    readonly URL: RegExp;
    /** UUID regex pattern (v4) */
    readonly UUID: RegExp;
};
export declare const ERRORS: {
    /** Generic error message (production) */
    readonly INTERNAL_SERVER_ERROR: "Internal Server Error";
    /** Input too large error */
    readonly INPUT_TOO_LARGE: (maxSize: number) => string;
    /** Validation error messages */
    readonly VALIDATION: {
        readonly REQUIRED: (field: string) => string;
        readonly INVALID_TYPE: (field: string, type: string) => string;
        readonly MIN_LENGTH: (field: string, min: number) => string;
        readonly MAX_LENGTH: (field: string, max: number) => string;
        readonly MIN_VALUE: (field: string, min: number) => string;
        readonly MAX_VALUE: (field: string, max: number) => string;
        readonly INVALID_FORMAT: (field: string) => string;
        readonly INVALID_EMAIL: (field: string) => string;
        readonly INVALID_URL: (field: string) => string;
        readonly INVALID_UUID: (field: string) => string;
        readonly INVALID_ENUM: (field: string, values: unknown[]) => string;
        readonly MIN_ITEMS: (field: string, min: number) => string;
        readonly MAX_ITEMS: (field: string, max: number) => string;
    };
};
export declare const BLOCKED: "[BLOCKED]";
//# sourceMappingURL=constants.d.ts.map