import type { NextFunction, Request, RequestHandler, Response } from 'express';
import type { Server } from 'node:http';
export interface CorsPolicyOptions {
    environmentPrefix: string;
    methods: string[];
    allowedOrigins?: string[];
    defaultMode?: CorsMode;
    allowedHeaders?: string[];
    exposedHeaders?: string[];
    allowCredentials?: boolean;
    maxAgeSeconds?: number;
}
export type CorsMode = 'public' | 'allowlist' | 'disabled';
export interface SecurityHeadersOptions {
    environmentPrefix?: string;
    contentSecurityPolicy?: string | false;
    crossOriginResourcePolicy?: 'same-origin' | 'same-site' | 'cross-origin' | false;
    crossOriginOpenerPolicy?: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none' | false;
    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
    permissionsPolicy?: string | false;
    strictTransportSecurity?: boolean;
}
export interface HttpServerPolicyDefaults {
    requestTimeoutMs: number;
    headersTimeoutMs: number;
    keepAliveTimeoutMs: number;
    socketTimeoutMs: number;
    maxRequestsPerSocket: number;
    /** Open TCP/WebSocket connections retained by one process. Default: 1,000. */
    maxConnections?: number;
}
export type ResourceProfileName = 'small' | 'standard' | 'high-throughput';
export interface ResourceProfileValues {
    small: number;
    standard: number;
    highThroughput: number;
}
/**
 * Reads an operator resource limit. `-1` and `unlimited` are explicit opt-outs;
 * omitting the setting always retains the service's tested safe default.
 */
export declare function readResourceLimit(environmentPrefix: string, suffix: string, fallback: number, maximum?: number): number;
export declare function readResourceProfile(environmentPrefix: string, fallback?: ResourceProfileName): ResourceProfileName;
export declare function profileValue(profile: ResourceProfileName, values: ResourceProfileValues): number;
export declare function readAllowedOrigins(environmentPrefix: string): string[];
/**
 * Socket.IO and similar transports can consume the same public/allowlist/
 * disabled policy as the HTTP middleware.
 */
export declare function readCorsOriginSetting(environmentPrefix: string, defaultMode?: CorsMode): '*' | string[];
/**
 * Public protocol services accept browser origins by default and return
 * Access-Control-Allow-Origin: * without cookie credentials. Operators can
 * opt into an exact allowlist or disable cross-origin browser calls with
 * <PREFIX>_CORS_MODE.
 */
export declare function corsPolicy(options: CorsPolicyOptions): RequestHandler;
export declare function securityHeaders(options?: SecurityHeadersOptions): RequestHandler;
export declare function readBodyLimitBytes(environmentPrefix: string, fallback: number, maximum?: number): number;
/**
 * Preserve compatibility with clients that accidentally emit two or more
 * initial slashes. Only the initial slash run is normalized; the remainder of
 * the path and query string is unchanged.
 */
export declare function initialDoubleSlashCompatibility(req: Request, _res: Response, next: NextFunction): void;
/**
 * Bounds materialized JSON/text/binary Express responses before downstream
 * authentication middleware signs or serializes them again. Streaming
 * endpoints must enforce their own byte budget while producing chunks.
 */
export declare function responseSizeLimit(environmentPrefix: string, fallback: number, maximum?: number): RequestHandler;
/**
 * Convert body-parser/Express parser failures into stable, non-sensitive
 * protocol errors. Install immediately after all body parsers.
 */
export declare function bodyParserErrorHandler(error: unknown, _req: Request, res: Response, next: NextFunction): void;
/**
 * A local concurrency ceiling prevents a single process from accepting
 * unbounded in-flight application work. Distributed/global quotas remain the
 * responsibility of the deployment's shared rate-limit store or gateway.
 */
export declare function concurrencyLimit(environmentPrefix: string, fallback: number): RequestHandler;
export declare function configureHttpServer(server: Server, environmentPrefix: string, defaults: HttpServerPolicyDefaults): void;
//# sourceMappingURL=edgePolicy.d.ts.map