/**
 * @module @arcis/node/sanitizers/ldap
 * LDAP injection prevention
 *
 * LDAP special characters in filter context: * ( ) \ NUL
 * LDAP special characters in DN context:     , + < > ; " = / \ NUL
 *
 * RFC 4515 (filter) and RFC 4514 (DN) define the escaping rules.
 * Sanitization escapes rather than strips — preserves the original value
 * while making it safe to embed in LDAP queries.
 */
/**
 * Sanitizes a string for safe use in LDAP filter expressions.
 * Escapes * ( ) \ and NUL per RFC 4515.
 *
 * @example
 * sanitizeLdapFilter("user*(admin)")
 * // Returns: "user\2a\28admin\29"
 */
export declare function sanitizeLdapFilter(input: string): string;
/**
 * Sanitizes a string for safe use in LDAP Distinguished Names (DN).
 * Escapes , + < > ; " = / \ and NUL per RFC 4514.
 *
 * @example
 * sanitizeLdapDn("cn=admin,dc=example")
 * // Returns: "cn\3dadmin\2cdc\3dexample"
 */
export declare function sanitizeLdapDn(input: string): string;
/**
 * Detects potential LDAP injection patterns in a string.
 * Does not sanitize — use sanitizeLdapFilter() or sanitizeLdapDn() for that.
 *
 * Designed for request-boundary scanning: matches only the specific
 * shapes real LDAP injection produces. The older broad
 * `[*()\\\x00]` pattern was removed because it false-positived on
 * every markdown bold `**bold**`, every parenthesised string, every
 * apostrophe-in-name. Mirrors the `ldap-injection-strict` +
 * `ldap-not-bypass` rules from packages/core/patterns.json which are
 * marked `request_boundary_safe: true`. Benchmark FP class B2, 2026-06-07.
 *
 * @param input - The string to check
 * @returns True if LDAP injection patterns detected
 *
 * @example
 * detectLdapInjection("*)(uid=*))(|(uid=*")  // true  — filter break-out
 * detectLdapInjection("(uid=*)")              // true  — wildcard value
 * detectLdapInjection("ad\x00min")            // true  — NUL truncation
 * detectLdapInjection("**bold**")             // false — markdown
 * detectLdapInjection("hello *world*")        // false — emphasis
 * detectLdapInjection("john")                 // false
 */
export declare function detectLdapInjection(input: string): boolean;
//# sourceMappingURL=ldap.d.ts.map