/**
 * @module @arcis/node/middleware/hpp
 * HTTP Parameter Pollution (HPP) protection middleware
 *
 * Normalizes duplicate query and body parameters to their last value,
 * preventing attackers from bypassing validation by repeating parameters.
 *
 * Attack example:
 *   GET /search?role=user&role=admin
 *   Without HPP: req.query.role = ['user', 'admin']
 *   With HPP:    req.query.role = 'admin'  (last value wins)
 *
 * Originals are preserved in req.queryPolluted / req.bodyPolluted
 * for logging or auditing without blocking the request.
 */
import type { RequestHandler } from 'express';
/** HPP protection configuration */
export interface HppOptions {
    /**
     * Parameters that legitimately accept arrays and should not be normalized.
     * Example: ['tags', 'ids', 'filter']
     */
    whitelist?: string[];
    /** Normalize duplicate query string parameters. Default: true */
    checkQuery?: boolean;
    /** Normalize duplicate body parameters. Default: true */
    checkBody?: boolean;
}
/**
 * HTTP Parameter Pollution protection middleware.
 *
 * Normalizes duplicate query/body parameters to a single value (last wins).
 * Whitelisted parameters are allowed to remain as arrays.
 *
 * @param options - HPP configuration
 * @returns Express middleware
 *
 * @example
 * // Basic — normalize all duplicates
 * app.use(hpp());
 *
 * @example
 * // Allow arrays for specific params (e.g., tag filters, IDs)
 * app.use(hpp({ whitelist: ['tags', 'ids'] }));
 *
 * @example
 * // Inspect what was removed (for logging)
 * app.use((req, res, next) => {
 *   const polluted = (req as any).queryPolluted;
 *   if (Object.keys(polluted).length) logger.warn('HPP detected', polluted);
 *   next();
 * });
 */
export declare function hpp(options?: HppOptions): RequestHandler;
export declare const createHpp: typeof hpp;
//# sourceMappingURL=hpp.d.ts.map