/**
 * @module @arcis/node/validation/host-header
 * Host-header validation (V41 — Host-header poisoning / subdomain-takeover).
 *
 * Apps that reflect the `Host` header into password-reset links, absolute
 * redirects, share URLs, or cache keys are vulnerable when an attacker sends
 * `Host: attacker.com`. This validator checks the Host against a configured
 * allowlist.
 *
 * Default-deny by construction: an empty allowlist rejects everything, so this
 * is OPT-IN — only meaningful once the app passes its real allowlist. That
 * avoids false positives on multi-tenant apps that legitimately serve many
 * Hosts (they either don't use this, or list their tenants).
 */
export interface ValidateHostResult {
    /** True when the Host header is in the allowlist. */
    safe: boolean;
    /** Human-readable reason when not safe. */
    reason?: string;
}
/**
 * Validate a Host header against an allowlist. Case-insensitive, port-stripped.
 * Supports a single-level leading `*.` wildcard: `*.example.com` matches
 * `a.example.com` but not `example.com` or `a.b.example.com`.
 *
 * @example
 * validateHost('app.example.com:443', ['app.example.com']) // { safe: true }
 * validateHost('evil.com', ['app.example.com'])            // { safe: false }
 * validateHost('a.example.com', ['*.example.com'])          // { safe: true }
 * validateHost('x', [])                                     // { safe: false } (default-deny)
 */
export declare function validateHost(host: string, allowlist: string[]): ValidateHostResult;
/** Boolean convenience wrapper around {@link validateHost}. */
export declare function isHostAllowed(host: string, allowlist: string[]): boolean;
//# sourceMappingURL=host-header.d.ts.map