/**
 * @module @arcis/node/core/constants
 * Named constants for Arcis - no magic numbers
 */
export declare const INPUT: {
    /** Default maximum input size (1MB) */
    readonly DEFAULT_MAX_SIZE: 1000000;
    /** Maximum recursion depth for nested objects */
    readonly MAX_RECURSION_DEPTH: 10;
};
export declare const RATE_LIMIT: {
    /** Default window size (1 minute) */
    readonly DEFAULT_WINDOW_MS: 60000;
    /** Default max requests per window */
    readonly DEFAULT_MAX_REQUESTS: 100;
    /** Default HTTP status code for rate limited responses */
    readonly DEFAULT_STATUS_CODE: 429;
    /** Default error message */
    readonly DEFAULT_MESSAGE: "Too many requests, please try again later.";
    /** Minimum window size (1 second) */
    readonly MIN_WINDOW_MS: 1000;
    /** Maximum window size (24 hours) */
    readonly MAX_WINDOW_MS: 86400000;
};
export declare const HEADERS: {
    /** Default Content Security Policy */
    readonly DEFAULT_CSP: string;
    /** Default HSTS max age (1 year in seconds) */
    readonly HSTS_MAX_AGE: 31536000;
    /** Default X-Frame-Options value */
    readonly FRAME_OPTIONS: "DENY";
    /** Default X-Content-Type-Options value */
    readonly CONTENT_TYPE_OPTIONS: "nosniff";
    /** Default Referrer-Policy value */
    readonly REFERRER_POLICY: "strict-origin-when-cross-origin";
    /** Default Permissions-Policy value */
    readonly PERMISSIONS_POLICY: "geolocation=(), microphone=(), camera=()";
    /** Default Cache-Control value for security */
    readonly CACHE_CONTROL: "no-store, no-cache, must-revalidate, proxy-revalidate";
};
/**
 * Detection patterns — used to flag whether a string contains XSS payloads.
 * Must stay in sync with XSS_REMOVE_PATTERNS below.
 */
export declare const XSS_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
/**
 * Removal patterns — used by sanitizeXss() to strip dangerous content.
 * More targeted than XSS_PATTERNS: each pattern captures the full dangerous
 * substring (tag, attribute + value, protocol) so it can be replaced safely.
 * Must stay in sync with XSS_PATTERNS above.
 */
export declare const XSS_REMOVE_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
export declare const SQL_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
export declare const PATH_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
export declare const COMMAND_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];
/**
 * Prototype pollution keys to block.
 * Stored lowercase — always compare with key.toLowerCase().
 *
 * Includes:
 * - __proto__: direct prototype assignment
 * - constructor: access to constructor.prototype chain
 * - prototype: direct prototype property
 * - __defineGetter__/__defineSetter__: legacy property definition (can override getters/setters)
 * - __lookupGetter__/__lookupSetter__: legacy property introspection
 */
export declare const DANGEROUS_PROTO_KEYS: Set<string>;
/** MongoDB operators to block */
export declare const NOSQL_DANGEROUS_KEYS: Set<string>;
export declare const REDACTION: {
    /** Replacement text for redacted values */
    readonly REPLACEMENT: "[REDACTED]";
    /** Truncation indicator */
    readonly TRUNCATED: "[TRUNCATED]";
    /** Max depth indicator */
    readonly MAX_DEPTH: "[MAX_DEPTH]";
    /** Default max message length */
    readonly DEFAULT_MAX_LENGTH: 10000;
    /** Default sensitive keys to redact */
    readonly SENSITIVE_KEYS: Set<string>;
};
export declare const VALIDATION: {
    /**
     * Email regex pattern.
     * Rejects consecutive dots in local part (e.g. test..foo@example.com),
     * leading/trailing dots, and other common invalid forms.
     */
    readonly EMAIL: RegExp;
    /**
     * URL regex pattern.
     * Only allows http:// and https:// (case-insensitive scheme per
     * RFC 3986); explicitly rejects javascript:, data:, vbscript:, and
     * other dangerous URI schemes.
     */
    readonly URL: RegExp;
    /** UUID regex pattern (v4) */
    readonly UUID: RegExp;
};
export declare const ERRORS: {
    /** Generic error message (production) */
    readonly INTERNAL_SERVER_ERROR: "Internal Server Error";
    /** Input too large error */
    readonly INPUT_TOO_LARGE: (maxSize: number) => string;
    /** Validation error messages */
    readonly VALIDATION: {
        readonly REQUIRED: (field: string) => string;
        readonly INVALID_TYPE: (field: string, type: string) => string;
        readonly MIN_LENGTH: (field: string, min: number) => string;
        readonly MAX_LENGTH: (field: string, max: number) => string;
        readonly MIN_VALUE: (field: string, min: number) => string;
        readonly MAX_VALUE: (field: string, max: number) => string;
        readonly INVALID_FORMAT: (field: string) => string;
        readonly INVALID_EMAIL: (field: string) => string;
        readonly INVALID_URL: (field: string) => string;
        readonly INVALID_UUID: (field: string) => string;
        readonly INVALID_ENUM: (field: string, values: unknown[]) => string;
        readonly MIN_ITEMS: (field: string, min: number) => string;
        readonly MAX_ITEMS: (field: string, max: number) => string;
    };
};
export declare const BLOCKED: "[BLOCKED]";
//# sourceMappingURL=constants.d.ts.map