/**
 * Generate a signed CSRF token: `<random>.<hmac>`.
 * The random half is the token proper; the HMAC binds it to the server secret
 * so an attacker who plants a fake cookie can't forge the tag.
 *
 * @param {string | Buffer} secret — at least 32 bytes of entropy
 * @param {{ length?: number }} [options]
 * @returns {string}
 */
declare function generate(secret: string | Buffer, options?: {
    length?: number;
}): string;
/**
 * Verify a signed CSRF token. Returns true iff:
 *   - both values are present and structurally valid,
 *   - the two values are identical (timing-safe),
 *   - the HMAC tag matches the current secret.
 *
 * Never throws for invalid input — a malformed or missing token is just an
 * unauthenticated request. Only throws `SecurityError` on programmer error
 * (bad secret).
 *
 * @param {unknown} fromCookie
 * @param {unknown} fromHeader
 * @param {string | Buffer} secret
 * @returns {boolean}
 */
declare function verify(fromCookie: unknown, fromHeader: unknown, secret: string | Buffer): boolean;
/**
 * Generate an unsigned random token. Use only when there is no server secret
 * available — the check is a plain equality between cookie and header, so a
 * planted cookie will pass. `generate` is preferred.
 *
 * @param {{ length?: number }} [options]
 * @returns {string}
 */
declare function generateUnsigned(options?: {
    length?: number;
}): string;
/**
 * Verify an unsigned CSRF token — plain timing-safe equality of cookie and
 * form/header value.
 *
 * @param {unknown} fromCookie
 * @param {unknown} fromForm
 * @returns {boolean}
 */
declare function verifyUnsigned(fromCookie: unknown, fromForm: unknown): boolean;
/**
 * Generate a session-bound CSRF token: `hmacBase64Url(sessionId, secret)`.
 * Requires no per-request storage — the value is derived from state the
 * server already has. When the session expires, so does the token.
 *
 * @param {string} sessionId — non-empty session identifier
 * @param {string | Buffer} secret
 * @returns {string}
 */
declare function generateForSession(sessionId: string, secret: string | Buffer): string;
/**
 * Verify a session-bound CSRF token against the current session.
 *
 * @param {unknown} token
 * @param {string} sessionId
 * @param {string | Buffer} secret
 * @returns {boolean}
 */
declare function verifyForSession(token: unknown, sessionId: string, secret: string | Buffer): boolean;

declare const index_d_generate: typeof generate;
declare const index_d_generateForSession: typeof generateForSession;
declare const index_d_generateUnsigned: typeof generateUnsigned;
declare const index_d_verify: typeof verify;
declare const index_d_verifyForSession: typeof verifyForSession;
declare const index_d_verifyUnsigned: typeof verifyUnsigned;
declare namespace index_d {
  export {
    index_d_generate as generate,
    index_d_generateForSession as generateForSession,
    index_d_generateUnsigned as generateUnsigned,
    index_d_verify as verify,
    index_d_verifyForSession as verifyForSession,
    index_d_verifyUnsigned as verifyUnsigned,
  };
}

/**
 * Fixed-window rate limiter.
 *
 * Every window boundary resets the counter to zero. Cheap (one INCR per
 * request) but permits burst at boundary edges — a caller can spend the
 * whole budget in the last second of one window and the whole budget in
 * the first second of the next. Prefer sliding for user-facing APIs; fixed
 * is fine for "cheap-and-lax" scenarios like debounce or dedup.
 *
 * @param {import('../index.js').WindowLimiterConfig} config
 * @returns {import('../index.js').Limiter}
 */
declare function fixed(config: WindowLimiterConfig): Limiter;

/**
 * Interpolated sliding-window rate limiter.
 *
 * Approximates a true sliding window using two fixed buckets — the current
 * window's counter plus a weighted slice of the previous window's counter,
 * where the weight is the fraction of the previous window still overlapping
 * with "now". This costs the same as fixed (~1 write) but eliminates the
 * boundary burst that plagues fixed windows.
 *
 * Accuracy: ~1% off ground truth in the worst case (Cloudflare / Kong /
 * Envoy all ship this variant as their default). For strict per-user API
 * quotas this is normally within a few requests of the true count.
 *
 * @param {import('../index.js').WindowLimiterConfig} config
 * @returns {import('../index.js').Limiter}
 */
declare function sliding(config: WindowLimiterConfig): Limiter;

/**
 * Token-bucket rate limiter.
 *
 * A bucket of `capacity` tokens refills at `refillRate` tokens per second.
 * Every request consumes one token; if the bucket is empty, the request is
 * rejected. Allows *controlled burst* — an idle caller accumulates a full
 * bucket and can spend it at once, then drops to the steady rate.
 *
 * State is stored as a single JSON blob per key: `{ tokens, updatedAt }`.
 * Tokens are recomputed on read from the elapsed time — no background
 * timer needed.
 *
 * Because token accounting is more than a simple counter, this reads the
 * state, recomputes, and writes it back. When the store exposes the
 * optional atomic `compareAndSet` (the bundled memory and Redis stores
 * both do), the write is a CAS retried on contention — concurrent
 * requests can never double-spend a token. Stores without it fall back
 * to a last-writer-wins `set`, which can race under concurrency.
 *
 * @param {import('../index.js').BucketLimiterConfig} config
 * @returns {import('../index.js').Limiter}
 */
declare function tokenBucket(config: BucketLimiterConfig): Limiter;

/**
 * Leaky-bucket rate limiter.
 *
 * The bucket accumulates requests up to `capacity`. Water leaks out at a
 * constant `leakRate` requests/second — the effective steady-state rate.
 * When the bucket is full, incoming requests are rejected. Unlike
 * token-bucket, there is **no burst tolerance**: outgoing rate is
 * strictly bounded by `leakRate`.
 *
 * Use for traffic shaping and protecting downstream services with a hard
 * throughput ceiling (SMTP relays, upstream APIs with quota-per-second).
 * For user-facing endpoints, prefer `sliding` or `tokenBucket`.
 *
 * State encoding matches token-bucket: `"<level*1000>|<updatedAt>"`.
 * Writes go through the store's optional atomic `compareAndSet` when
 * available (bundled memory + Redis stores both provide it) so
 * concurrent requests can't race the level; stores without it fall
 * back to last-writer-wins `set`.
 *
 * @param {import('../index.js').BucketLimiterConfig} config
 * @returns {import('../index.js').Limiter}
 */
declare function leakyBucket(config: BucketLimiterConfig): Limiter;

/**
 * Combine multiple limiters into one. A request is allowed only if **every**
 * inner limiter allows it; when any denies, the request is rejected with
 * the strictest `retryAfter` (max over deniers).
 *
 * Use for API-key style layered quotas — e.g. 100/min AND 1k/hour AND 10k/day.
 * Each inner limiter is a fully-formed limiter object; they can differ in
 * algorithm, window, or even backing store.
 *
 * @param {{ limiters: Array<import('./index.js').Limiter> }} config
 * @returns {import('./index.js').Limiter}
 */
declare function multi(config: {
    limiters: Array<Limiter>;
}): Limiter;

/**
 * Wrap any limiter with a violation-count ban policy. When a caller
 * triggers `threshold` denials within `trackingWindow`, we bump them to
 * a hard ban for `banDuration` — subsequent `.check()` calls short-circuit
 * to denied without touching the base limiter.
 *
 * Sits nicely on top of a stricter-than-you-need limiter: the base
 * limiter catches ordinary abuse, `withBan` catches persistent abuse
 * cheaply (a single `store.get` per request while in the ban window,
 * no HMAC / no algorithm work).
 *
 *   const limiter = rateLimit.withBan(
 *     rateLimit.sliding({ requests: 20, window: '1m', store }),
 *     { store, threshold: 5, banDuration: '1h' },
 *   )
 *
 * State is written with the prefixes `bs:v:<key>` (violation counter,
 * TTL = trackingWindow) and `bs:b:<key>` (ban marker, TTL = banDuration).
 * You can share the base limiter's store or provide a dedicated one.
 *
 * @param {import('./index.js').Limiter} limiter
 * @param {{
 *   store: import('./index.js').RateLimitStore,
 *   threshold: number,
 *   banDuration: string | number,
 *   trackingWindow?: string | number,
 * }} options
 * @returns {import('./index.js').Limiter}
 */
declare function withBan(limiter: Limiter, options: {
    store: RateLimitStore;
    threshold: number;
    banDuration: string | number;
    trackingWindow?: string | number;
}): Limiter;

declare function memoryStore(options?: {}): {
    get(key: any): Promise<{
        count: number;
        expiresAt: number;
    } | null>;
    read(key: any): Promise<{
        count: number;
        expiresAt: number;
    } | null>;
    incr(key: any, ttlMs: any): Promise<{
        count: number;
        expiresAt: any;
    }>;
    set(key: any, count: any, ttlMs: any): Promise<void>;
    decr(key: any): Promise<void>;
    compareAndSet(key: any, expected: any, value: any, ttlMs: any): Promise<boolean>;
    delete(key: any): Promise<void>;
    reset(key: any): Promise<void>;
    _size: () => number;
    _stop: () => void;
};

/**
 * Wrap a user-supplied store into the interface the rate-limit algorithms
 * expect. Validates that the required methods exist so misconfigurations
 * surface at startup, not at the first blocked request.
 *
 * Required methods (all may be async):
 *   - `get(key)`                  → { count, expiresAt } | null
 *   - `incr(key, ttlMs)`          → { count, expiresAt }   (atomic)
 *   - `set(key, count, ttlMs)`    → void
 *   - `delete(key)`               → void
 *
 * Optional:
 *   - `reset(key)`                → void (defaults to `delete`)
 *   - `decr(key)`                 → void — atomic decrement of an existing
 *     key. When provided, `sliding` uses it for race-free rollback of a
 *     rejected request's tentative increment.
 *   - `compareAndSet(key, expected, value, ttlMs)` → boolean — atomic CAS
 *     (`expected: null` = key must not exist). When provided,
 *     `tokenBucket` / `leakyBucket` become race-free under concurrency.
 *
 * Atomicity guarantee: `incr` must be atomic across concurrent callers. On
 * Redis, wrap `INCR + EXPIRE` in a Lua script or MULTI/EXEC. On Mongo, use
 * `findOneAndUpdate` with upsert. Non-atomic implementations race and let
 * requests bypass the limit under load.
 *
 * @param {Partial<import('../index.js').RateLimitStore>} impl
 * @returns {import('../index.js').RateLimitStore}
 */
declare function customStore(impl: Partial<RateLimitStore>): RateLimitStore;

/**
 * Redis-compatible store. Works with any client that exposes:
 *   - `eval(script, numkeys, ...args)`  → number | string
 *   - `pttl(key)`                       → number (ms; -2 missing, -1 no ttl)
 *   - `get(key)`                        → string | null
 *   - `set(key, value, 'PX', ms)`       → 'OK'
 *   - `del(key)`                        → number
 *
 * Verified compat: `ioredis`, `node-redis` (v4+), `@upstash/redis` (HTTP,
 * works on Cloudflare Workers / Vercel Edge / Deno Deploy).
 *
 * Atomicity:
 *   - `incr` runs a single Lua script that INCR's the key and PEXPIRE's it
 *     only when the key is fresh (count == 1). TTL anchors to the first
 *     increment in the window — correct for fixed / token-bucket.
 *   - `read` runs a Lua script (GET + PTTL) so the snapshot is consistent
 *     even under contention.
 *
 * Optimization: when the client is `ioredis` (detected via `defineCommand`),
 * both scripts are registered once as named commands. Subsequent calls go
 * out as `EVALSHA`, saving the script body on every request.
 *
 * Namespacing: every key is prefixed with `rl:` by default so this adapter
 * doesn't collide with your application keys. Configurable via `prefix`.
 *
 * @param {object} client                 Redis-compatible client instance.
 * @param {{ prefix?: string }} [options]
 * @returns {import('../index.js').RateLimitStore}
 */
declare function redisStore(client: object, options?: {
    prefix?: string;
}): RateLimitStore;

declare namespace rateLimit {
    export { fixed };
    export { sliding };
    export { tokenBucket };
    export { leakyBucket };
    export { multi };
    export { withBan };
    export namespace stores {
        export { memoryStore as memory };
        export { customStore as custom };
        export { redisStore as redis };
    }
}
/**
 * A store entry snapshot returned by `get` / `read` / `incr`.
 */
type StoreEntry = {
    /**
     * Current counter value for the key.
     */
    count: number;
    /**
     * Absolute unix-ms timestamp when the key
     * stops being valid.
     */
    expiresAt: number;
};
/**
 * The store contract every rate-limit backend must satisfy.
 *
 * All methods are async. `incr` must be atomic across concurrent callers —
 * the algorithm layer relies on that guarantee.
 */
type RateLimitStore = {
    /**
     *   Fetch current state. May refresh LRU position on stores that maintain one.
     */
    get: (key: string) => Promise<StoreEntry | null>;
    /**
     *   Non-mutating snapshot — does NOT refresh LRU / activity state.
     */
    read: (key: string) => Promise<StoreEntry | null>;
    /**
     *   Atomically increment (or create) the key and return the new state.
     */
    incr: (key: string, ttlMs: number) => Promise<StoreEntry>;
    /**
     *   Overwrite (or create) the key with an explicit count and TTL.
     */
    set: (key: string, count: number, ttlMs: number) => Promise<void>;
    delete: (key: string) => Promise<void>;
    reset: (key: string) => Promise<void>;
    /**
     * Optional: atomically decrement an existing key (no-op when absent;
     * never creates the key). `sliding` uses this to roll back its
     * tentative increment on rejection without racing concurrent `incr`s —
     * stores that omit it fall back to a read-modify-write rollback.
     */
    decr?: ((key: string) => Promise<void>) | undefined;
    /**
     * Optional: atomically write `value` only if the key's current stored
     * count equals `expected` (`null` = key must not exist). Returns
     * `true` when the write happened. `tokenBucket` / `leakyBucket` use
     * this as a CAS so concurrent requests can't double-spend a token —
     * stores that omit it fall back to last-writer-wins `set`.
     */
    compareAndSet?: ((key: string, expected: string | null, value: string | number, ttlMs: number) => Promise<boolean>) | undefined;
};
type CheckInput = {
    key: string;
};
type LimiterResult = {
    allowed: boolean;
    remaining: number;
    reset: Date | null;
    retryAfter: number | null;
};
/**
 * A composable limiter. Every algorithm and `multi()` returns this shape.
 */
type Limiter = {
    check: (input: CheckInput) => Promise<LimiterResult>;
};
type WindowLimiterConfig = {
    requests: number;
    /**
     * Duration string ('1m', '30s') or ms.
     */
    window: string | number;
    store: RateLimitStore;
};
type BucketLimiterConfig = {
    capacity: number;
    /**
     * Token-bucket only: tokens/second refill.
     */
    refillRate?: number | undefined;
    /**
     * Leaky-bucket only: leak rate in req/sec.
     */
    leakRate?: number | undefined;
    store: RateLimitStore;
};

/**
 * Build a CORS decision function.
 *
 *   const check = cors({ origin: ['https://app.example.com'], credentials: true })
 *
 *   // In your framework middleware:
 *   const d = check({
 *     method: req.method,
 *     origin: req.headers.origin,
 *     requestMethod: req.headers['access-control-request-method'],
 *     requestHeaders: req.headers['access-control-request-headers'],
 *   })
 *   for (const [k, v] of Object.entries(d.headers)) res.setHeader(k, v)
 *   if (d.preflight) { res.statusCode = d.status; res.end(); return }
 *   if (!d.allowed) { res.statusCode = 403; res.end(); return }
 *
 * The returned function is pure — no state, safe to reuse across requests
 * and across workers. When the configured `origin` predicate is async
 * (returns a Promise), `check()` returns `Promise<CorsDecision>`; for sync
 * predicates it stays synchronous so hot paths don't pay a needless await.
 *
 * @param {CorsOptions} [options]
 * @returns {(input: CorsInput) => CorsDecision | Promise<CorsDecision>}
 */
declare function cors(options?: CorsOptions): (input: CorsInput) => CorsDecision | Promise<CorsDecision>;
type OriginMatcher = string | RegExp;
type CorsOptions = {
    /**
     * Which origins are allowed to make cross-origin requests.
     * - `true`  → reflect any origin (echoes back the request's `Origin`).
     * - `false` → CORS disabled; every cross-origin request is denied.
     * - string  → exact match against the request's `Origin`.
     * - RegExp  → pattern match.
     * - Array   → any-of match against the entries.
     * - Function → sync or async predicate; return true (or resolve to true) to allow.
     * When the predicate is async, `check()` returns a Promise<CorsDecision>;
     * for sync predicates it stays sync so consumers pay no async cost.
     */
    origin?: boolean | OriginMatcher | OriginMatcher[] | ((origin: string | undefined) => boolean | Promise<boolean>) | undefined;
    /**
     * Comma-separated string or array. Default:
     * `['GET','HEAD','PUT','PATCH','POST','DELETE']`. Sent as
     * `Access-Control-Allow-Methods` on preflight only.
     */
    methods?: string | string[] | undefined;
    /**
     * Headers the browser may include on the actual request. Default `true` =
     * echo the request's `Access-Control-Request-Headers`. Sent on preflight.
     */
    allowedHeaders?: string | true | string[] | undefined;
    /**
     * Response headers the browser may read via `getResponseHeader()`. Sent
     * on the actual response.
     */
    exposedHeaders?: string | string[] | undefined;
    /**
     * When true, sets `Access-Control-Allow-Credentials: true`. Requires an
     * exact-echoed origin — cannot be combined with the `*` wildcard.
     */
    credentials?: boolean | undefined;
    /**
     * Seconds the browser may cache the preflight decision. Sent on preflight.
     */
    maxAge?: number | undefined;
    /**
     * HTTP status to end a preflight response with. Some legacy setups need
     * 200 instead — Chrome accepts either.
     */
    optionsSuccessStatus?: number | undefined;
};
type CorsInput = {
    /**
     * Request method (e.g. 'GET', 'OPTIONS').
     */
    method: string;
    /**
     * Value of the request's `Origin` header.
     */
    origin: string | undefined;
    /**
     * `Access-Control-Request-Method` on preflight.
     */
    requestMethod?: string | undefined;
    /**
     * `Access-Control-Request-Headers` on preflight.
     */
    requestHeaders?: string | undefined;
};
type CorsDecision = {
    /**
     *   CORS response headers to merge onto the response.
     */
    headers: Record<string, string>;
    /**
     * Origin passed the policy check.
     */
    allowed: boolean;
    /**
     * Request was an OPTIONS preflight.
     */
    preflight: boolean;
    /**
     * Suggested response status for preflight.
     */
    status?: number | undefined;
};

/**
 * CSP directive map. Keys are camelCase; values are arrays of source
 * expressions. A value of `false` removes a default-provided directive.
 * @typedef {Record<string, string[] | false>} CspDirectives
 */
/**
 * @typedef {object} CspOptions
 * @property {CspDirectives} [directives]
 * @property {boolean} [useDefaults=true]
 * @property {boolean} [reportOnly=false]
 */
/**
 * @typedef {object} HstsOptions
 * @property {number} [maxAge=15552000]     Seconds. Default 180 days.
 * @property {boolean} [includeSubDomains=true]
 * @property {boolean} [preload=false]      Requires maxAge >= 1y + includeSubDomains.
 */
/**
 * @typedef {'DENY' | 'SAMEORIGIN' | { action: 'DENY' | 'SAMEORIGIN' }} FrameguardOptions
 */
/**
 * @typedef {object} PermissionsPolicyOptions
 * @property {Record<string, string[]>} [features]
 */
/**
 * A static-value policy option:
 *   true → default value, false → skip,
 *   string / { value } → verbatim override.
 * @typedef {boolean | string | { value: string } | undefined} StaticHeaderOption
 */
/**
 * @typedef {object} HeadersOptions
 * @property {boolean | CspOptions} [contentSecurityPolicy]
 * @property {boolean | HstsOptions} [hsts]
 * @property {boolean | HstsOptions} [strictTransportSecurity] Alias of `hsts`.
 * @property {StaticHeaderOption} [contentTypeOptions]
 * @property {StaticHeaderOption} [dnsPrefetchControl]
 * @property {StaticHeaderOption} [downloadOptions]
 * @property {StaticHeaderOption} [permittedCrossDomainPolicies]
 * @property {StaticHeaderOption} [originAgentCluster]
 * @property {StaticHeaderOption} [xssProtection]
 * @property {StaticHeaderOption} [crossOriginOpenerPolicy]
 * @property {StaticHeaderOption} [crossOriginEmbedderPolicy]
 * @property {StaticHeaderOption} [crossOriginResourcePolicy]
 * @property {StaticHeaderOption} [referrerPolicy]
 * @property {boolean | FrameguardOptions} [frameguard]
 * @property {boolean | PermissionsPolicyOptions} [permissionsPolicy]
 */
/**
 * Build a map of HTTP security headers.
 *
 * `headers()` with no options ships secure-by-default headers suitable for
 * an HTTPS API or SSR app. Each policy can be opted out with `false` or
 * customized via its own options object — see the individual `build*`
 * functions in `./policies.js` for supported shapes.
 *
 *   import { headers } from '@exortek/security'
 *
 *   const map = headers({
 *     hsts: { maxAge: 31536000, preload: true },
 *     contentSecurityPolicy: {
 *       directives: { scriptSrc: ["'self'", "https://cdn.example.com"] },
 *     },
 *     crossOriginEmbedderPolicy: false,  // COEP breaks many embeds
 *     frameguard: 'SAMEORIGIN',
 *   })
 *   // → { 'Content-Security-Policy': "...", 'Strict-Transport-Security': "...", ... }
 *
 * For per-request CSP nonces, use `cspNonce()` and template the resulting
 * string into `directives.scriptSrc` before calling `headers()`.
 *
 * Returns a plain `{ [name]: value }` object. Framework middleware iterates
 * and calls the framework's response setter; consumers can also assign the
 * map directly onto a Response.
 *
 * @param {HeadersOptions} [options]
 * @returns {Record<string, string>}
 */
declare function headers(options?: HeadersOptions): Record<string, string>;
/**
 * Generate a fresh CSP nonce.
 *
 * A nonce is a random per-response value; embed the SAME nonce in your CSP
 * `script-src` (as `'nonce-<value>'`) and on every inline `<script nonce>`
 * so the browser executes only whitelisted inline scripts. Regenerate on
 * every response — a reused nonce defeats the purpose.
 *
 * Default 16 bytes (128 bits) → base64 → 22 chars, MDN's recommended size.
 *
 * @param {number} [bytes=16]
 * @returns {string} base64-encoded nonce
 */
declare function cspNonce(bytes?: number): string;
type CspOptions = {
    directives?: Record<string, false | string[]> | undefined;
    useDefaults?: boolean | undefined;
    reportOnly?: boolean | undefined;
};
type HstsOptions = {
    /**
     * Seconds. Default 180 days.
     */
    maxAge?: number | undefined;
    includeSubDomains?: boolean | undefined;
    /**
     * Requires maxAge >= 1y + includeSubDomains.
     */
    preload?: boolean | undefined;
};
type FrameguardOptions = "DENY" | "SAMEORIGIN" | {
    action: "DENY" | "SAMEORIGIN";
};
type PermissionsPolicyOptions = {
    features?: Record<string, string[]> | undefined;
};
/**
 * A static-value policy option:
 *   true → default value, false → skip,
 *   string / { value } → verbatim override.
 */
type StaticHeaderOption = boolean | string | {
    value: string;
} | undefined;
type HeadersOptions = {
    contentSecurityPolicy?: boolean | CspOptions | undefined;
    hsts?: boolean | HstsOptions | undefined;
    /**
     * Alias of `hsts`.
     */
    strictTransportSecurity?: boolean | HstsOptions | undefined;
    contentTypeOptions?: StaticHeaderOption;
    dnsPrefetchControl?: StaticHeaderOption;
    downloadOptions?: StaticHeaderOption;
    permittedCrossDomainPolicies?: StaticHeaderOption;
    originAgentCluster?: StaticHeaderOption;
    xssProtection?: StaticHeaderOption;
    crossOriginOpenerPolicy?: StaticHeaderOption;
    crossOriginEmbedderPolicy?: StaticHeaderOption;
    crossOriginResourcePolicy?: StaticHeaderOption;
    referrerPolicy?: StaticHeaderOption;
    frameguard?: boolean | FrameguardOptions | undefined;
    permissionsPolicy?: boolean | PermissionsPolicyOptions | undefined;
};

/**
 * Guard against open-redirect abuse.
 *
 * Given a user-supplied redirect target (e.g. `?next=...`), return either
 * that target (if it passes every check) or a safe fallback. Never trust
 * the input value on its own — always redirect to `result.url`.
 *
 *   const result = safeRedirect(req.query.next, {
 *     allowedHosts: ['app.example.com', '*.example.com'],
 *     defaultTo: '/dashboard',
 *   })
 *   if (!result.safe) log.warn({ reason: result.reason, next: req.query.next })
 *   res.redirect(result.url)
 *
 * Rejected inputs (the returned `reason` codes):
 *   - `empty`               — missing / non-string
 *   - `illegal-chars`       — whitespace, control chars, backslashes
 *   - `protocol-relative`   — `//evil.com/foo` (browsers resolve to host)
 *   - `relative-not-allowed`— path input while `allowRelative: false`
 *   - `malformed`           — URL constructor threw
 *   - `scheme`              — scheme not in allowlist, or hard-banned
 *   - `userinfo`            — `https://evil@safe.com` phishing trick
 *   - `host`                — hostname not in `allowedHosts`
 *
 * @param {unknown} input                           The user-supplied redirect target.
 * @param {SafeRedirectOptions} [options]
 * @returns {SafeRedirectResult}
 */
declare function safeRedirect(input: unknown, options?: SafeRedirectOptions): SafeRedirectResult;
/**
 * @typedef {object} ExtractReturnUrlOptions
 * @property {string[]} [queryParams=['next','return_to','returnTo','redirect','redirect_uri']]
 *   Query param names to check, in priority order.
 * @property {string | string[]} [headerName]
 *   Header name(s) to fall back to (e.g. `'x-return-to'`). Case-insensitive.
 * @property {string} [cookieName]
 *   Cookie name to check as a last resort. Requires cookies to be
 *   pre-parsed onto `req.cookies` (adapter middleware does this).
 */
/**
 * Pick the user-supplied "come back to" URL from wherever the client
 * stashed it — query string, header, or cookie. Returns the first
 * non-empty candidate. Does NOT validate — pipe the result into
 * `safeRedirect` before actually redirecting:
 *
 *   const raw = extractReturnUrl(req, {
 *     queryParams: ['next', 'return_to'],
 *     headerName: 'x-return-to',
 *   })
 *   const { safe, url } = safeRedirect(raw, { allowedHosts: [...] })
 *   res.redirect(url)
 *
 * @param {{
 *   query?: Record<string, unknown>,
 *   headers?: Record<string, string | string[] | undefined>,
 *   cookies?: Record<string, string | undefined>,
 * }} req
 * @param {ExtractReturnUrlOptions} [options]
 * @returns {string | undefined}
 */
declare function extractReturnUrl(req: {
    query?: Record<string, unknown>;
    headers?: Record<string, string | string[] | undefined>;
    cookies?: Record<string, string | undefined>;
}, options?: ExtractReturnUrlOptions): string | undefined;
/**
 * Compare two URLs by origin (scheme + host + port). Uses WHATWG URL
 * parsing so `https://example.com` and `https://example.com:443/foo`
 * compare equal. Returns `false` on any parse failure — never throws.
 *
 * Complements `checkOrigin`, which reads `Origin` / `Referer` headers off
 * a request. `isSameOrigin` is the primitive both callers land on when
 * they need direct URL-to-URL comparison (OAuth callback validation,
 * Referer-based flow checks, allowlist-of-one matching).
 *
 * @param {string | URL | undefined | null} a
 * @param {string | URL | undefined | null} b
 * @returns {boolean}
 */
declare function isSameOrigin(a: string | URL | undefined | null, b: string | URL | undefined | null): boolean;
type ExtractReturnUrlOptions = {
    /**
     * Query param names to check, in priority order.
     */
    queryParams?: string[] | undefined;
    /**
     * Header name(s) to fall back to (e.g. `'x-return-to'`). Case-insensitive.
     */
    headerName?: string | string[] | undefined;
    /**
     * Cookie name to check as a last resort. Requires cookies to be
     * pre-parsed onto `req.cookies` (adapter middleware does this).
     */
    cookieName?: string | undefined;
};
type SafeRedirectOptions = {
    /**
     * Where to send the user when the input fails validation. Must itself be
     * a safe target — validated on option parse.
     */
    defaultTo?: string | undefined;
    /**
     * Hostnames (case-insensitive) that are trusted external targets. Use a
     * leading `*.` for subdomain wildcards: `*.example.com` matches
     * `app.example.com` and `sub.app.example.com` but NOT `example.com`
     * itself. Absolute URLs whose hostname doesn't match any entry are
     * rejected. Omit to disallow all absolute URLs.
     */
    allowedHosts?: string | string[] | undefined;
    /**
     * Schemes permitted on absolute URLs. `javascript:` / `data:` / `vbscript:`
     * are ALWAYS rejected regardless of this option — a bug in your allowlist
     * shouldn't turn into XSS.
     */
    allowedSchemes?: string[] | undefined;
    /**
     * Whether same-origin paths (`/foo`, `/foo?bar`) are accepted. Turn off
     * for flows where you want an explicit allowlist even for internal URLs.
     */
    allowRelative?: boolean | undefined;
};
type SafeRedirectResult = {
    /**
     * True if the input was accepted; false when
     * the returned `url` is the fallback.
     */
    safe: boolean;
    /**
     * The URL you should redirect to.
     */
    url: string;
    /**
     * When unsafe, a short code explaining why
     * (`'empty' | 'illegal-chars' | 'protocol-relative'
     *  | 'malformed' | 'scheme' | 'userinfo' | 'host'
     *  | 'relative-not-allowed'`). Useful for logging.
     */
    reason?: string | undefined;
};

/**
 * @typedef {object} SlowDownConfig
 * @property {import('../rate-limit/index.js').RateLimitStore} store
 * @property {string | number} window   Duration string ('1m', '30s') or ms.
 * @property {number} delayAfter        First `delayAfter` requests are free;
 *                                     subsequent ones get progressively delayed.
 * @property {number} delayMs           Base per-request delay after the free window.
 * @property {number} [maxDelayMs=20000]  Cap the per-request delay.
 * @property {'linear' | 'exponential'} [growth='linear']
 *   `linear`: delay = delayMs * excess.
 *   `exponential`: delay = delayMs * 2^(excess - 1) (capped by maxDelayMs).
 */
/**
 * Progressive-delay throttle — a "soft" rate limiter that never rejects but
 * slows abusers down. Sits nicely IN FRONT of a hard limiter: `slowDown`
 * catches naive scrapers cheaply, the limiter catches the persistent ones.
 *
 * The returned object exposes `.check({ key })` matching the rate-limit
 * contract, so `multi({ limiters: [slowDown(...), rateLimit.fixed(...)] })`
 * composes them.
 *
 * **DoS caveat.** The delay is implemented by holding the request open on
 * `setTimeout` — each slowed request continues to occupy a socket + an
 * event-loop slot for the duration of its delay. An attacker who does not
 * care about latency can trivially exhaust concurrent connections. Always
 * pair with (a) a hard `maxConnections` on `http.Server` or a `limit_conn`
 * at your reverse proxy, and (b) a real rejecting limiter downstream (fed
 * by `multi({ limiters: [slowDown(...), rateLimit.sliding(...)] })`) so the
 * abuser eventually gets a `429` and the socket is released.
 *
 * @param {SlowDownConfig} config
 * @returns {{ check: (input: { key: string }) => Promise<{
 *   allowed: boolean, remaining: number, reset: Date | null,
 *   retryAfter: number | null, delayMs: number,
 * }> }}
 */
declare function slowDown(config: SlowDownConfig): {
    check: (input: {
        key: string;
    }) => Promise<{
        allowed: boolean;
        remaining: number;
        reset: Date | null;
        retryAfter: number | null;
        delayMs: number;
    }>;
};
type SlowDownConfig = {
    store: RateLimitStore;
    /**
     * Duration string ('1m', '30s') or ms.
     */
    window: string | number;
    /**
     * First `delayAfter` requests are free;
     * subsequent ones get progressively delayed.
     */
    delayAfter: number;
    /**
     * Base per-request delay after the free window.
     */
    delayMs: number;
    /**
     * Cap the per-request delay.
     */
    maxDelayMs?: number | undefined;
    /**
     * `linear`: delay = delayMs * excess.
     * `exponential`: delay = delayMs * 2^(excess - 1) (capped by maxDelayMs).
     */
    growth?: "linear" | "exponential" | undefined;
};

/**
 * Extract the real client IP from a request-like object, honouring a
 * trust-proxy allowlist. Node behind a load balancer sees the LB's IP
 * in `req.socket.remoteAddress`; the real client sits inside
 * `X-Forwarded-For` — but only reachable safely by walking the header
 * **right-to-left** past the trusted proxy hops, because a client can
 * forge left-most entries and every conforming proxy *appends* the
 * real address.
 *
 * ### `trustProxy` semantics
 *
 * | Value              | Meaning                                                                                     |
 * | ------------------ | ------------------------------------------------------------------------------------------- |
 * | `false` (default)  | Ignore XFF entirely; return `socket.remoteAddress`. Only correct when Node is edge-facing.  |
 * | `true`             | Trust every hop. Returns the left-most XFF entry — **spoofable unless the first proxy strips inbound XFF**. |
 * | `string[]`         | Right-to-left walk skipping entries whose value is in the set; returns the first untrusted hop. |
 *
 * ### `proxyCount`
 *
 * Alternative to `trustProxy: string[]` when the proxy chain depth is
 * known but the addresses aren't stable (e.g. Cloudflare + a k8s
 * ingress). Skips **N** rightmost XFF entries and returns the
 * `(N + 1)`-th from the right — i.e. the last hop before the trusted
 * chain begins. Wins over `trustProxy` when both are set.
 *
 * @param {{
 *   headers?: Record<string, string | string[] | undefined>,
 *   socket?: { remoteAddress?: string },
 *   ip?: string,
 * }} req
 * @param {{
 *   trustProxy?: boolean | string[],
 *   proxyCount?: number,
 *   headers?: string[],
 * }} [options]
 * @returns {string | undefined}
 */
declare function getClientIp(req: {
    headers?: Record<string, string | string[] | undefined>;
    socket?: {
        remoteAddress?: string;
    };
    ip?: string;
}, options?: {
    trustProxy?: boolean | string[];
    proxyCount?: number;
    headers?: string[];
}): string | undefined;
/**
 * Parse an `Authorization: Bearer <token>` header. Case-insensitive on the
 * scheme (RFC 7235 §2.1). Returns the token, or `null` when the header is
 * missing / malformed / uses a different scheme.
 *
 * @param {string | undefined | null} headerValue
 * @returns {string | null}
 */
declare function bearer(headerValue: string | undefined | null): string | null;
/**
 * Defensive Origin / Referer check for state-changing requests. GET / HEAD
 * are usually excluded; POST / PUT / DELETE / PATCH should carry a same-
 * origin `Origin` header (`Referer` as a fallback for older browsers).
 *
 * Complements CORS: CORS controls cross-origin READS, this catches CSRF-
 * like requests where a cookie is present but Origin doesn't match.
 *
 * @param {{
 *   method?: string,
 *   headers?: Record<string, string | undefined>,
 * }} req
 * @param {{
 *   allowedOrigins: Array<string | RegExp>,
 *   safeMethods?: string[],
 * }} options
 * @returns {boolean} true if the request may proceed
 */
declare function checkOrigin(req: {
    method?: string;
    headers?: Record<string, string | undefined>;
}, options: {
    allowedOrigins: Array<string | RegExp>;
    safeMethods?: string[];
}): boolean;
/**
 * Verify a webhook payload against an HMAC signature (constant-time).
 *
 * `signatureHeader` may be the plain hex digest OR a scheme-prefixed
 * variant like `sha256=<hex>` (GitHub convention). Multiple
 * comma-separated candidates are accepted, and any candidate that
 * matches wins.
 *
 * For Stripe-style timestamped envelopes (`t=<ts>,v1=<hex>`) use
 * {@link webhookVerifyStripe} — those need a replay-tolerance window
 * this helper deliberately does not enforce.
 *
 * @param {string | Buffer} payload    Raw request body — DO NOT stringify JSON first.
 * @param {string} signatureHeader     Value from the incoming signature header.
 * @param {string | Buffer} secret     Shared secret (32 bytes minimum recommended).
 * @param {{ algorithm?: 'sha256' | 'sha512' }} [options]
 *   `algorithm` — HMAC hash. Restricted to `sha256` (default) and
 *   `sha512`; anything else throws. Weaker hashes (`sha1`) are
 *   deliberately not accepted even though `node:crypto` supports them.
 * @returns {boolean}
 */
declare function webhookVerify(payload: string | Buffer, signatureHeader: string, secret: string | Buffer, options?: {
    algorithm?: "sha256" | "sha512";
}): boolean;
/**
 * Verify a Stripe-style timestamped webhook envelope (constant-time
 * HMAC + replay-tolerance window).
 *
 * The header is a comma-separated list of `key=value` pairs:
 *
 *   `t=1614265636,v1=<hex>,v0=<hex>`
 *
 * where `t` is a Unix timestamp in **seconds**, `v1` is the HMAC-SHA-256
 * of `${t}.${payload}` (Stripe's current scheme, and what this helper
 * checks), and `v0` is the legacy scheme (this helper ignores it).
 * Multiple `v1=<hex>` entries are accepted — Stripe rotates secrets by
 * signing with several at once.
 *
 * The signature check is timing-safe; a stale timestamp fails without
 * running the HMAC compare (freshness gates freshness, not signature
 * validity).
 *
 * @param {string | Buffer} payload    Raw request body — DO NOT stringify JSON first.
 * @param {string} signatureHeader     Stripe's `Stripe-Signature` header value.
 * @param {string | Buffer | Array<string | Buffer>} secret
 *   Endpoint signing secret (or array of secrets for rotation). Any
 *   candidate that matches wins.
 * @param {{ tolerance?: number, now?: number }} [options]
 *   `tolerance` — allowed clock skew in **seconds**. Default 300s
 *   (Stripe's own recommendation). Both past and future skew are
 *   checked so a clock drift on either side rejects the same way.
 *   `now` — override for tests. Unix seconds.
 * @returns {boolean}
 */
declare function webhookVerifyStripe(payload: string | Buffer, signatureHeader: string, secret: string | Buffer | Array<string | Buffer>, options?: {
    tolerance?: number;
    now?: number;
}): boolean;

/**
 * Defensive NoSQL / operator-injection sanitizer. Walks the value tree
 * and either drops or rejects keys that look like operators or nested
 * paths. Idempotent, allocates a new object rather than mutating input.
 *
 * Also unconditionally strips the prototype-pollution vectors `__proto__`,
 * `constructor`, and `prototype`, and writes output keys as own properties
 * (never via the prototype chain) so a `__proto__` key in the input can't
 * shift the returned object's prototype.
 *
 * @param {unknown} input
 * @param {SanitizeBodyOptions} [options]
 * @returns {unknown}
 */
declare function sanitizeBody(input: unknown, options?: SanitizeBodyOptions): unknown;
/**
 * @typedef {object} SanitizeParamsOptions
 * @property {'first' | 'last' | 'array'} [mode='first']
 *   How to collapse duplicate query keys.
 *     - `first` — take the earliest value (safest default; matches most
 *       server-side language runtimes).
 *     - `last`  — take the trailing value.
 *     - `array` — leave arrays as-is; caller handles ambiguity.
 * @property {number} [maxParams=1000]
 *   Reject payloads with more distinct keys than this — a soft DoS guard.
 */
/**
 * HTTP Parameter Pollution (HPP) sanitizer. Different runtimes disagree on
 * how to interpret `?x=1&x=2`; attackers exploit the divergence between
 * parser and business logic. This normalizes to a single value per key.
 *
 * @param {Record<string, unknown>} query    Parsed query object.
 * @param {SanitizeParamsOptions} [options]
 * @returns {Record<string, unknown>}
 */
declare function sanitizeParams(query: Record<string, unknown>, options?: SanitizeParamsOptions): Record<string, unknown>;
/**
 * Resolve a user-provided path segment(s) within a fixed base directory.
 * Guards against `..` traversal, absolute-path smuggling, and null-byte
 * tricks. Returns the fully-resolved absolute path when safe, or throws
 * SecurityError when the joined path escapes the base.
 *
 * @param {string} base                   Absolute base directory (trusted).
 * @param {...string} segments            User-controlled path pieces.
 * @returns {string}                      Absolute, canonicalized path.
 */
declare function safeJoin(base: string, ...segments: string[]): string;
/**
 * Normalize a user-supplied filename into something safe to write to disk
 * on Windows, macOS, and Linux. Strips path separators, control chars,
 * reserved Windows names, and leading/trailing dots.
 *
 * @param {unknown} input
 * @param {SanitizeFilenameOptions} [options]
 * @returns {string}
 */
declare function sanitizeFilename(input: unknown, options?: SanitizeFilenameOptions): string;
type SanitizeParamsOptions = {
    /**
     * How to collapse duplicate query keys.
     * - `first` — take the earliest value (safest default; matches most
     * server-side language runtimes).
     * - `last`  — take the trailing value.
     * - `array` — leave arrays as-is; caller handles ambiguity.
     */
    mode?: "first" | "last" | "array" | undefined;
    /**
     * Reject payloads with more distinct keys than this — a soft DoS guard.
     */
    maxParams?: number | undefined;
};
type SanitizeBodyOptions = {
    /**
     * `strip` silently removes suspicious keys; `reject` throws
     * SecurityError. Use `reject` on trusted APIs where a bad shape
     * indicates a bug (or attack) worth alerting on.
     */
    mode?: "strip" | "reject" | undefined;
    /**
     * Test applied to each own-property key. Default catches MongoDB
     * operators (`$gt`, `$where`, …) and dotted keys (`a.b.c`) that
     * Mongoose interprets as nested paths.
     */
    suspicious?: RegExp | undefined;
    /**
     * Recursion guard against pathological / self-referential payloads.
     *
     * Regardless of `suspicious`, the prototype-pollution keys `__proto__`,
     * `constructor`, and `prototype` are ALWAYS treated as dangerous — they
     * cannot be re-enabled by narrowing the regex.
     */
    maxDepth?: number | undefined;
};
type SanitizeFilenameOptions = {
    /**
     * Replacement for illegal characters.
     */
    replacement?: string | undefined;
    /**
     * Cap the returned length.
     */
    maxLength?: number | undefined;
    /**
     * Returned when everything got stripped.
     */
    fallback?: string | undefined;
};

/**
 * Freeze the built-in prototypes to defend against prototype pollution.
 * After calling this, code like `req.body.__proto__.isAdmin = true` becomes
 * a no-op (silent in sloppy mode, TypeError in strict). Call once at boot
 * BEFORE loading user code / requiring third-party modules that might set
 * legitimate prototype properties.
 *
 * Idempotent — safe to call multiple times.
 *
 * **`options.exclude`** lets callers opt specific defaults out. In
 * practice `Date.prototype` and `RegExp.prototype` are the ones that
 * legitimate polyfills (Temporal shims, some ORMs' custom serialisers)
 * patch after boot, so those are the usual candidates —
 * `freezePrototypes({ exclude: ['Date', 'RegExp'] })`. Every other
 * default should stay frozen unless you know why you're loosening it.
 *
 * @param {{ additional?: object[], exclude?: string[] }} [options]
 *   `additional`: extra objects to freeze (e.g. custom global classes).
 *   `exclude`: constructor names to drop from the default freeze list
 *              (`'Date'`, `'RegExp'`, …). Silently ignored for names
 *              not in the defaults.
 * @returns {number}   Count of prototypes frozen.
 */
declare function freezePrototypes(options?: {
    additional?: object[];
    exclude?: string[];
}): number;
/**
 * Race a promise against a timeout. Throws `SecurityError` with
 * `REQUEST_TIMEOUT` when the deadline hits before the promise settles.
 * The underlying promise keeps running — cancellation of Node primitives
 * (setTimeout, fs) needs an AbortController, which this helper doesn't
 * own. Caller passes one in via `options.signal` if it matters.
 *
 * @template T
 * @param {Promise<T>} promise
 * @param {number} ms
 * @param {{ label?: string, signal?: AbortSignal }} [options]
 * @returns {Promise<T>}
 */
declare function timeout<T>(promise: Promise<T>, ms: number, options?: {
    label?: string;
    signal?: AbortSignal;
}): Promise<T>;
/**
 * Body-size guard. Given a claimed content length, returns whether the
 * request may proceed. Middleware should also enforce the limit while
 * reading the body (a lying Content-Length is still an attack surface).
 *
 * @param {number | string | undefined | null} contentLength
 * @param {number} maxBytes
 * @returns {{ ok: boolean, reason?: 'missing' | 'invalid' | 'too-large' }}
 */
declare function bodyLimit(contentLength: number | string | undefined | null, maxBytes: number): {
    ok: boolean;
    reason?: "missing" | "invalid" | "too-large";
};
/**
 * @typedef {object} HoneypotOptions
 * @property {string} [fieldName='website']
 *   Common decoys: `website`, `email_address_confirm`, `phone2`.
 * @property {boolean} [caseInsensitive=false]
 */
/**
 * Honeypot check. Modern spam bots blindly fill every form field; a hidden
 * field left empty by the browser is a strong bot signal when it comes
 * back with content. Returns `true` when the request looks like a bot.
 *
 * @param {Record<string, unknown> | undefined | null} body
 * @param {HoneypotOptions} [options]
 * @returns {boolean}
 */
declare function honeypot(body: Record<string, unknown> | undefined | null, options?: HoneypotOptions): boolean;
type HoneypotOptions = {
    /**
     * Common decoys: `website`, `email_address_confirm`, `phone2`.
     */
    fieldName?: string | undefined;
    caseInsensitive?: boolean | undefined;
};

/**
 * Parse JSON with a prototype-pollution guard. Complements
 * `freezePrototypes()` — that closes the door on writes to
 * `Object.prototype` globally; `safeJsonParse` closes the door at the
 * request boundary where user-controlled JSON enters.
 *
 * Returns `null` on any failure (parse error, banned key in `reject`
 * mode, oversize input) so callers can uniformly branch on `!result`.
 *
 * @param {string | Buffer} input
 * @param {SafeJsonParseOptions} [options]
 * @returns {unknown | null}
 */
declare function safeJsonParse(input: string | Buffer, options?: SafeJsonParseOptions): unknown | null;
/**
 * Constant-time equality for user-supplied tokens / signatures.
 *
 * `node:crypto`'s `timingSafeEqual` throws when lengths differ — which
 * itself leaks length via the exception path. This wrapper accepts
 * strings or byte views, returns `false` on length mismatch without
 * throwing, and burns a fixed amount of comparison time in that path.
 *
 * @param {string | Buffer | Uint8Array} a
 * @param {string | Buffer | Uint8Array} b
 * @returns {boolean}
 */
declare function constantTimeEqual(a: string | Buffer | Uint8Array, b: string | Buffer | Uint8Array): boolean;
/**
 * @typedef {object} CspReport
 * @property {string | undefined} documentUri
 * @property {string | undefined} referrer
 * @property {string | undefined} blockedUri
 * @property {string | undefined} effectiveDirective
 * @property {string | undefined} violatedDirective
 * @property {string | undefined} disposition       'enforce' | 'report'
 * @property {number | undefined} statusCode
 * @property {string | undefined} sourceFile
 * @property {number | undefined} lineNumber
 * @property {number | undefined} columnNumber
 * @property {string | undefined} sample
 * @property {string | undefined} originalPolicy
 */
/**
 * Normalize a CSP violation report submitted to a `report-uri` or
 * `report-to` endpoint into a flat object. Browsers ship two dialects:
 *
 *   1. Legacy `report-uri` (Content-Type: application/csp-report)
 *      `{ "csp-report": { "blocked-uri": "...", ... } }`
 *   2. Modern `report-to` (Content-Type: application/reports+json)
 *      `[ { "type": "csp-violation", "body": { "blockedURL": "...", ... } } ]`
 *
 * Both use kebab / snake / camelCase inconsistently across engines.
 * This helper takes the raw body (string OR already-parsed object) and
 * returns a single normalized shape. Returns `null` when the body is
 * not a recognizable CSP report.
 *
 * @param {unknown} body
 * @returns {CspReport | null}
 */
declare function parseCspReport(body: unknown): CspReport | null;
type CspReport = {
    documentUri: string | undefined;
    referrer: string | undefined;
    blockedUri: string | undefined;
    effectiveDirective: string | undefined;
    violatedDirective: string | undefined;
    /**
     * 'enforce' | 'report'
     */
    disposition: string | undefined;
    statusCode: number | undefined;
    sourceFile: string | undefined;
    lineNumber: number | undefined;
    columnNumber: number | undefined;
    sample: string | undefined;
    originalPolicy: string | undefined;
};
type SafeJsonParseOptions = {
    /**
     * How to react to `__proto__` / `constructor` / `prototype` keys.
     * - `reject` (default): return `null`, the parsed result is discarded.
     * - `strip`:  silently drop the offending keys, keep the rest.
     * - `throw`:  raise `SecurityError` — surface bad payloads loudly.
     */
    mode?: "strip" | "reject" | "throw" | undefined;
    /**
     * Refuses to walk beyond this level. Guards against pathological /
     * self-referential payloads that could stall the event loop.
     */
    maxDepth?: number | undefined;
    /**
     * Reject the input outright when longer than this. Comes before the
     * parse, so we never actually construct a huge object graph.
     */
    maxBytes?: number | undefined;
    /**
     * Keys that are considered dangerous. Defaults cover the classic
     * prototype-pollution vectors; extend if your app has extra concerns.
     */
    banned?: Set<string> | undefined;
};

/**
 * Shared base error class — the single error structure behind every
 * `@exortek/*` package's `errors.js`.
 *
 * Every package keeps its own class identity with a one-liner subclass;
 * codes stay per-package frozen maps, status mapping is declared as a
 * static field:
 *
 *   import { BaseError } from '@exortek/shared/errors';
 *
 *   export const ErrorCode = Object.freeze({
 *     INVALID_ARGUMENT: 'INVALID_ARGUMENT',
 *     INVALID_TOKEN: 'INVALID_TOKEN',
 *   });
 *
 *   export class JwtError extends BaseError {
 *     static statuses = { INVALID_ARGUMENT: 400, INVALID_TOKEN: 401 };
 *     static defaultStatus = 500;
 *   }
 *
 * Instances carry a stable machine-readable `code` (branch on this,
 * never on the message), an optional HTTP `status`, an optional
 * `details` object, and the standard `cause` chain.
 */
declare class BaseError extends Error {
    /**
     * Optional `code → HTTP status` map declared on the subclass. When
     * absent the instance carries no `status` at all — for HTTP-agnostic
     * packages like `@exortek/crypto`.
     *
     * @type {Record<string, number> | undefined}
     */
    static statuses: Record<string, number> | undefined;
    /**
     * Fallback status for codes missing from `statuses`.
     *
     * @type {number}
     */
    static defaultStatus: number;
    /**
     * @param {string} code    Stable machine-readable code; branch on this.
     * @param {string} message Human-readable diagnostic. Free-form; may
     *                         change across versions.
     * @param {{ cause?: unknown, status?: number, details?: Record<string, unknown> }} [options]
     */
    constructor(code: string, message: string, options?: {
        cause?: unknown;
        status?: number;
        details?: Record<string, unknown>;
    });
    /** @type {string} */
    code: string;
    /** @type {number | undefined} */
    status: number | undefined;
    /** @type {Record<string, unknown> | undefined} */
    details: Record<string, unknown> | undefined;
}

declare const ErrorCode: Readonly<{
    INVALID_ARGUMENT: "INVALID_ARGUMENT";
    PATH_TRAVERSAL: "PATH_TRAVERSAL";
    BODY_TOO_LARGE: "BODY_TOO_LARGE";
    REQUEST_TIMEOUT: "REQUEST_TIMEOUT";
}>;
/**
 * Every recoverable failure raised by this package. Carries a stable
 * `code` (from {@link ErrorCode}) and an HTTP `status` (400 unless
 * overridden via `options.status`).
 */
declare class SecurityError extends BaseError {
    static statuses: {};
}

export { ErrorCode, SecurityError, bearer, bodyLimit, checkOrigin, constantTimeEqual, cors, cspNonce, index_d as csrf, extractReturnUrl, freezePrototypes, getClientIp, headers, honeypot, isSameOrigin, parseCspReport, rateLimit, safeJoin, safeJsonParse, safeRedirect, sanitizeBody, sanitizeFilename, sanitizeParams, slowDown, timeout, webhookVerify, webhookVerifyStripe };