/**
 * Literal / glob / regex string matching, compiled to a composable
 * {@link Predicate}.
 *
 * A configurable allow-list is the same shape everywhere in this repo: a list of
 * patterns from a config field or an env var, where an operator reasonably
 * expects to write a plain value, a `*` wildcard, or - when neither is enough -
 * a real regex. This module is the single parser for those three forms.
 *
 * Three shapes are recognized per entry, tried in order:
 *
 * - **regex** - wrapped in slashes (`/^x-mastra-/`, with optional trailing
 *   flags). Compiled as written. An invalid regex never matches: it is skipped
 *   with a warning rather than throwing, so one bad entry cannot take a process
 *   down at startup.
 * - **glob** - contains `*` or `?` (`x-mastra-*`). Shell-style, anchored at both
 *   ends: `*` matches any run of characters, `?` exactly one.
 * - **literal** - anything else. Whole-string equality.
 *
 * Matching is case-INSENSITIVE by default, which is what the callers want (HTTP
 * header names and email addresses are both case-insensitive); pass
 * `caseSensitive` to opt out. An empty pattern list matches NOTHING, so a
 * caller that treats "no patterns" as "permit everything" must special-case it
 * rather than relying on the matcher.
 *
 * Browser-safe: hand-compiled to `RegExp` with no glob dependency, so this stays
 * usable from a client bundle. Node code that needs path-aware globbing
 * (`/` as a segment boundary, `**`) wants `@dbx-tools/path`'s `toPathMatcher`
 * instead - that one is `minimatch`-backed and understands path semantics.
 *
 * @example
 * const allowed = toPatternMatcher(["x-mastra-*", "/^x-trace-/"]);
 * allowed("x-mastra-thread-id"); // true
 * allowed("x-forwarded-user");   // false
 *
 * @module
 */
import * as predicate from "./predicate.ts";
/** Options for {@link toPattern} / {@link toPatternMatcher}. */
export interface PatternOptions {
    /** Match case-sensitively. Default `false` (case-insensitive). */
    caseSensitive?: boolean;
}
/** Escape a string for literal use inside a `RegExp`. */
export declare function escapeRegExp(value: string): string;
/**
 * Compile ONE pattern into a predicate, or `undefined` when the entry is empty
 * or an unparseable regex literal.
 *
 * Callers that want a whole list should use {@link toPatternMatcher}; this is
 * exported for the case where a consumer applies its own semantics to some
 * shapes and only wants the glob/regex handling (the email gate's bare-domain
 * shortcut, for one).
 */
export declare function toPattern(pattern: string, options?: PatternOptions): predicate.Predicate<string> | undefined;
/**
 * Compile patterns into a single OR'd {@link Predicate}. Accepts the raw config
 * shapes {@link parseList} does - an array, or one comma/whitespace-separated
 * string - so a field and its env var need no separate handling.
 *
 * With no usable patterns the result always returns `false`.
 *
 * @example
 * const forwardable = toPatternMatcher(process.env.TUNNEL_FORWARD_HEADERS);
 */
export declare function toPatternMatcher(patterns: string | readonly string[] | undefined | null, options?: PatternOptions): predicate.Predicate<string>;