/**
 * Validate a single `Host`-style value (hostname / IP with optional port).
 * Returns the cleaned value, or null when it is missing, malformed, or
 * carries characters that are never legitimate in a Host header (CR/LF,
 * whitespace, path separators, userinfo, ...).
 */
export declare function sanitizeHost(raw: string | null | undefined): string | null;
export interface RequestOriginInput {
    headers: {
        get(name: string): string | null | undefined;
    };
    /** Fallback host when neither forwarding headers nor `Host` yield a valid value. */
    defaultHost?: string;
    /** Fallback protocol when `x-forwarded-proto` is absent or invalid. */
    defaultProtocol?: "http" | "https";
    /** Prefer the authenticated edge-only public-host header for link lookup. */
    trustPublicHost?: boolean;
    publicHostHeader?: string;
    publicProtoHeader?: string;
    /** Also consult `x-forwarded-host` (only when the forwarding hop is trusted to set it). */
    trustForwardedHost?: boolean;
}
/**
 * Resolve the validated absolute origin for a request.
 *
 * For public edge requests, valid `configured public-proto header` and
 * `configured public-host header` win. Otherwise protocol honors `x-forwarded-proto`
 * (http/https whitelist only), and host uses trusted `x-forwarded-host`, then
 * `Host`, then the caller default. Returns null only when every host candidate
 * is missing or malformed.
 */
export declare function resolvePublicOrigin(input: RequestOriginInput): string | null;