/**
 * @module @arcis/node/sanitizers/xpath
 * XPath injection prevention.
 *
 * XPath 1.0 has no escape syntax for string literals — the only way to
 * embed user input safely is parameterised queries / variable bindings.
 * Neither libxml2 nor most JS XPath libraries expose a canonical escape
 * function. The pragmatic answer everyone ships:
 *
 *   - Detect: scan for unescaped quotes or expression-control chars
 *     that suggest the user is trying to break out of a string literal.
 *   - Sanitize: strip the offending control characters. Lossy by design;
 *     callers that need lossless input should use parameterised queries
 *     directly.
 *
 * Detection is the load-bearing surface for this vector. Sanitization is
 * a fallback for users running existing XPath strings through user input
 * who can't switch to bound parameters today.
 */
/**
 * Detects XPath-injection-shaped patterns in a string. Returns true when
 * the input looks like it's trying to break out of an XPath string
 * literal or hijack the expression structure.
 *
 * Conservative on purpose: triggers on any control char in the input
 * combined with a boolean / union pattern. Plain user names and emails
 * (no quotes, no pipes) pass clean.
 */
export declare function detectXpathInjection(input: string): boolean;
/**
 * Strips XPath expression-control characters from a string. Lossy —
 * `O'Brien` becomes `OBrien`. Use only when migrating legacy code that
 * concatenates user input into XPath; new code should use bound
 * parameters via the underlying XPath library.
 */
export declare function sanitizeXpath(input: string): string;
//# sourceMappingURL=xpath.d.ts.map