/**
 * @module @arcis/node/sanitizers/headers
 * HTTP Header Injection & CRLF Injection prevention
 *
 * Prevents attackers from injecting newline characters (\r\n) into HTTP header
 * values, which can lead to response splitting, session fixation, XSS via
 * injected headers, and cache poisoning.
 */
import type { SanitizeResult } from '../core/types';
/**
 * Narrow header-injection check for request-boundary scanning. Returns
 * true only on a CRLF-then-header-name-then-colon shape, never on a bare
 * newline. Use this in `scanThreats`; use `detectHeaderInjection` (broad)
 * when sanitizing a value destined for a response header.
 */
export declare function detectHeaderInjectionStrict(input: string): boolean;
/**
 * Sanitizes a header value by stripping CRLF sequences, bare CR/LF, and null bytes.
 *
 * @param input - The header value to sanitize
 * @param collectThreats - Whether to collect threat information (default: false)
 * @returns Sanitized string or SanitizeResult if collectThreats is true
 *
 * @example
 * sanitizeHeaderValue("safe-value")
 * // Returns: "safe-value"
 *
 * sanitizeHeaderValue("value\r\nX-Injected: evil")
 * // Returns: "valueX-Injected: evil"
 */
export declare function sanitizeHeaderValue(input: string, collectThreats?: false): string;
export declare function sanitizeHeaderValue(input: string, collectThreats: true): SanitizeResult;
/**
 * Sanitizes an object of header key-value pairs.
 * Strips CRLF/null bytes from both keys and values.
 *
 * @param headers - Object with header names as keys and header values as values
 * @returns New object with sanitized header names and values
 *
 * @example
 * sanitizeHeaders({ "X-Custom": "safe", "X-Bad\r\n": "value\r\ninjected" })
 * // Returns: { "X-Custom": "safe", "X-Bad": "valueinjected" }
 */
export declare function sanitizeHeaders(headers: Record<string, string>): Record<string, string>;
/**
 * Checks if a string contains HTTP header injection patterns (CRLF, null bytes).
 * Does not sanitize — use sanitizeHeaderValue() for that.
 *
 * @param input - The string to check
 * @returns True if header injection patterns detected
 */
export declare function detectHeaderInjection(input: string): boolean;
/**
 * Email-header injection prevention. Same byte-level threat as HTTP
 * header injection — `\r\n` in a user-controlled email field
 * (`To`, `From`, `Subject`, etc.) lets an attacker inject extra headers
 * (most commonly Bcc) and pivot a contact form into a spam relay.
 *
 * Aliased to the HTTP-header sanitizers because the wire-level fix is
 * identical: strip CRLF + null bytes from the value before
 * concatenating into the header. Use these in form-to-email handlers:
 *
 * ```ts
 * const subject = sanitizeEmailHeader(req.body.subject);
 * const to = sanitizeEmailHeader(req.body.to);
 * if (detectEmailHeaderInjection(req.body.to)) reject(...);
 * ```
 */
export declare const sanitizeEmailHeader: typeof sanitizeHeaderValue;
export declare const detectEmailHeaderInjection: typeof detectHeaderInjection;
//# sourceMappingURL=headers.d.ts.map