/**
 * Header-name/value safety for user-supplied remote MCP credentials (PAP-17087).
 *
 * Both the guided "Connect your own MCP server" flow and the paste-config escape
 * hatch let an operator name arbitrary request headers for an arbitrary endpoint.
 * Those names reach a real outbound `fetch`, so they are validated here — once,
 * in shared code — instead of at each call site:
 *
 * - only RFC 9110 `token` characters, so a name can never smuggle a separator,
 *   whitespace, or CR/LF into the request line;
 * - never a hop-by-hop, framing, routing, or ambient-credential header, because
 *   those either belong to the transport or would let a pasted config redirect
 *   the request or attach a browser cookie;
 * - values must stay printable single-line, which blocks header/response
 *   splitting through a value that carries `\r\n`.
 *
 * `Authorization` is deliberately allowed: it is the header the bearer-key path
 * uses, and its value is stored as a Paperclip secret like every other one.
 */
export type McpRemoteHeaderRejection = "empty" | "too_long" | "invalid_characters" | "forbidden" | "value_too_long" | "value_control_characters";
export interface McpRemoteHeaderCheck {
    ok: boolean;
    reason?: McpRemoteHeaderRejection;
}
/**
 * Is `name` a header Paperclip is willing to send on a user-configured remote
 * MCP request? Returns the specific rejection reason so callers can produce an
 * actionable, UI-safe message.
 */
export declare function checkMcpRemoteHeaderName(name: string): McpRemoteHeaderCheck;
/**
 * Is `value` safe to send as a header value? Rejects CR/LF and other control
 * characters (header splitting) and absurdly long values.
 */
export declare function checkMcpRemoteHeaderValue(value: string): McpRemoteHeaderCheck;
export declare function isSafeMcpRemoteHeaderName(name: string): boolean;
export declare function isSafeMcpRemoteHeaderValue(value: string): boolean;
/** A UI-safe explanation for a rejected header. Never echoes the value. */
export declare function mcpRemoteHeaderRejectionMessage(headerName: string, reason: McpRemoteHeaderRejection): string;
/**
 * `credentialValues` keys use a `headers.<Name>` config path. Extract the header
 * name, or `null` when the path is not a header path.
 */
export declare function mcpRemoteHeaderNameFromConfigPath(configPath: string): string | null;
export declare const MCP_REMOTE_HEADER_LIMITS: {
    readonly maxNameLength: 128;
    readonly maxValueLength: 8192;
};
//# sourceMappingURL=mcp-remote-headers.d.ts.map