/**
 * Security Utilities
 *
 * HTML escaping, input detection, sanitization helpers,
 * timing-safe comparison, error sanitization, and request
 * correlation for safe, consistent security across all apps.
 */
/** Regex for protocol-prefixed URLs */
declare const URL_PROTOCOL_PATTERN: RegExp;
/** Regex for bare domain names with common TLDs */
declare const URL_DOMAIN_PATTERN: RegExp;
/** Regex for HTML tags */
declare const HTML_TAG_PATTERN: RegExp;
/**
 * Escape HTML special characters to prevent injection.
 * Use when inserting user content into HTML email templates or rendered HTML.
 */
declare function escapeHtml(str: string): string;
/** Check if a string contains protocol-prefixed URLs or bare domains */
declare function containsUrls(str: string): boolean;
/** Check if a string contains HTML tags */
declare function containsHtml(str: string): boolean;
/** Strip all HTML tags from a string */
declare function stripHtml(str: string): string;
/**
 * Defang URLs to prevent auto-linking in email clients.
 * Converts https://evil.com → hxxps://evil[.]com
 */
declare function defangUrl(str: string): string;
/**
 * Sanitize user content for safe insertion into HTML email templates.
 * Escapes HTML entities AND defangs any URLs that slipped through validation.
 */
declare function sanitizeForEmail(str: string): string;
/**
 * Constant-time string comparison to prevent timing side-channel attacks.
 * Use for comparing secrets, tokens, API keys, HMAC signatures, etc.
 *
 * Returns false (not throws) for length mismatches — still constant-time
 * relative to the shorter string to avoid leaking length info.
 *
 * @example
 * ```typescript
 * if (!constantTimeEqual(providedToken, expectedSecret)) {
 *   return { status: 401, error: 'Invalid token' }
 * }
 * ```
 */
declare function constantTimeEqual(a: string, b: string): boolean;
/**
 * Sanitize an error for client-facing API responses.
 *
 * - 4xx errors: returns the actual message (client needs to know what went wrong)
 * - 5xx errors: returns a generic message (never leak internals to clients)
 * - Development mode: optionally includes stack trace for debugging
 *
 * @example
 * ```typescript
 * catch (error) {
 *   const { message, code } = sanitizeApiError(error, 500)
 *   return Response.json({ error: message, code }, { status: 500 })
 * }
 * ```
 */
declare function sanitizeApiError(error: unknown, statusCode: number, isDevelopment?: boolean): {
    message: string;
    code?: string;
    stack?: string;
};
/**
 * Extract a correlation/request ID from standard headers, or generate one.
 *
 * Checks (in order): X-Request-ID, X-Correlation-ID, then falls back to
 * crypto.randomUUID(). Works with any headers-like object (plain object,
 * Headers API, or a getter function).
 *
 * @example
 * ```typescript
 * // With Next.js request
 * const id = getCorrelationId((name) => request.headers.get(name))
 *
 * // With plain object
 * const id = getCorrelationId({ 'x-request-id': 'abc-123' })
 * ```
 */
declare function getCorrelationId(headers: Record<string, string | string[] | undefined> | ((name: string) => string | null | undefined)): string;

export { HTML_TAG_PATTERN as H, URL_PROTOCOL_PATTERN as U, containsUrls as a, containsHtml as b, constantTimeEqual as c, sanitizeApiError as d, escapeHtml as e, defangUrl as f, getCorrelationId as g, sanitizeForEmail as h, URL_DOMAIN_PATTERN as i, stripHtml as s };
