/**
 * Spam scoring for public form submissions.
 *
 * Each enabled strategy contributes a reason; any reason flags the submission
 * as `spam` so it is hidden from the default inbox while still being persisted
 * (operators can review the spam folder and recover false positives). The
 * honeypot is always checked when a honeypot field exists — it is free and has
 * no false-positive risk for real users.
 *
 * This module is pure (no I/O) so it is trivially unit-testable and cannot leak
 * PII or make outbound calls.
 */
import type { FormField, FormSpamSettings, SpamProtectionStrategy, SpamStatus } from './types.js';
export interface SpamScoreInput {
    fields: FormField[];
    /** Raw (pre-validation) values — needed so the honeypot value is still visible. */
    rawValues: Record<string, unknown>;
    settings?: FormSpamSettings;
    /** Site-wide default strategies merged with the per-form strategy list. */
    defaultStrategies?: SpamProtectionStrategy[];
    senderEmail?: string | null;
    /** Milliseconds between form render and submit, when the client reports it. */
    elapsedMs?: number | null;
    /** Request `Origin` header (preferred) and `Referer` fallback for allowlisting. */
    origin?: string | null;
    referrer?: string | null;
}
export interface SpamScoreResult {
    status: SpamStatus;
    reasons: string[];
}
export declare function scoreSubmissionSpam(input: SpamScoreInput): SpamScoreResult;
//# sourceMappingURL=spam.d.ts.map