/**
 * @module @arcis/node/astro
 *
 * Astro adapter for Arcis. Drop into `src/middleware.ts`.
 *
 * **Scope:** rate-limit + bot detection + security headers. For
 * XSS/SQL/SSTI/etc. body-payload blocking, call `sanitizeObject` from
 * `@arcis/node/sanitizers` inside your endpoint handler. v1 keeps the
 * middleware surface narrow.
 *
 * ```ts
 * import { defineMiddleware } from 'astro:middleware';
 * import { onRequest as arcisOnRequest } from '@arcis/node/astro';
 * export const onRequest = arcisOnRequest({ rateLimit: { max: 100 }, bot: true });
 * ```
 *
 * Or compose with other middleware via `sequence`:
 *
 * ```ts
 * import { sequence } from 'astro:middleware';
 * import { onRequest as arcis } from '@arcis/node/astro';
 * export const onRequest = sequence(arcis(), authMiddleware);
 * ```
 *
 * Astro uses Web Fetch `Request`/`Response`, like SvelteKit, but the request
 * context exposes `clientAddress` as a getter property (not a method) and
 * `next()` takes no arguments. There is no runtime dependency on `astro` —
 * the middleware shape is duck-typed.
 */
import type { HeaderOptions, RateLimitOptions } from '../core/types';
import { type BotProtectionOptions } from './bot-detection';
interface AstroCookies {
    get(name: string): {
        value: string;
    } | undefined;
    set(name: string, value: string, opts?: {
        path?: string;
        [k: string]: unknown;
    }): void;
    delete(name: string, opts?: {
        path?: string;
    }): void;
}
export interface AstroAPIContext {
    request: Request;
    url: URL;
    cookies: AstroCookies;
    /** Astro exposes the client IP as a getter property, not a method. */
    clientAddress: string;
}
export type AstroMiddlewareNext = () => Promise<Response>;
export type AstroMiddlewareHandler = (context: AstroAPIContext, next: AstroMiddlewareNext) => Promise<Response>;
export interface ArcisAstroOptions {
    /** Security headers configuration. Default: enabled. Pass `false` to disable. */
    headers?: boolean | HeaderOptions;
    /** Rate limiter configuration. Default: 100 req/60s in-memory. Pass `false` to disable. */
    rateLimit?: boolean | RateLimitOptions;
    /** Bot protection. Default: disabled (opt-in). */
    bot?: boolean | BotProtectionOptions;
}
/**
 * Build an Astro `MiddlewareHandler` that applies Arcis protections in this
 * order on each request: rate limit (returns 429 if exceeded), bot detection
 * (returns 403 if denied), then runs `next()`, then mutates the resulting
 * response's headers with security defaults.
 */
export declare function onRequest(options?: ArcisAstroOptions): AstroMiddlewareHandler;
export default onRequest;
//# sourceMappingURL=astro.d.ts.map