/**
 * Cross-origin isolation response headers — the SINGLE source of truth for the
 * `Cross-Origin-Opener-Policy` / `Cross-Origin-Embedder-Policy` pair czap emits so
 * `SharedArrayBuffer`-backed workers (`@czap/worker`'s SPSC ring) get cross-origin
 * isolation.
 *
 * Owned here (next to `ClientHints`, the other header-vocabulary source) so every
 * consumer DERIVES from one list instead of hand-mirroring it (Law 6):
 *  - `@czap/astro`'s `CROSS_ORIGIN_HEADERS` builds itself from {@link CrossOriginIsolation.isolationHeaders};
 *  - `czap doctor --deployed`'s live header probe validates a deployed response's
 *    COOP/COEP against {@link CrossOriginIsolation.openerPolicy} / {@link CrossOriginIsolation.embedderPolicies}.
 * Pinned by tests/unit/astro/critical-ch-drift.test.ts (astro↔edge) so the emitter
 * and the validator can never request/emit/accept a different policy.
 *
 * @module
 */
/**
 * COEP values czap can emit; both establish cross-origin isolation. `require-corp`
 * is the default; `credentialless` loads CORP-less third-party subresources without
 * credentials instead of blocking them. The exported {@link CrossOriginEmbedderPolicy}
 * TYPE is DERIVED from this array, so the runtime accept-set and the compile-time
 * union can never diverge.
 */
declare const CROSS_ORIGIN_EMBEDDER_POLICIES: readonly ["require-corp", "credentialless"];
/**
 * COEP values czap can emit. Both establish cross-origin isolation (required for
 * `SharedArrayBuffer`); `credentialless` loads CORP-less third-party subresources
 * without credentials instead of blocking them.
 */
export type CrossOriginEmbedderPolicy = (typeof CROSS_ORIGIN_EMBEDDER_POLICIES)[number];
/** The COOP value that establishes cross-origin isolation (`same-origin`). */
declare function openerPolicy(): string;
/** Every COEP value that establishes cross-origin isolation (`require-corp`, `credentialless`). */
declare function embedderPolicies(): readonly CrossOriginEmbedderPolicy[];
/**
 * The COOP/COEP header pair czap emits for cross-origin isolation, in emit order
 * (COOP then COEP). `coep` selects the embedder policy; it defaults to
 * `require-corp`. Consumed by `@czap/astro`'s `CROSS_ORIGIN_HEADERS` so the emitted
 * values derive from this one source.
 */
declare function isolationHeaders(coep?: CrossOriginEmbedderPolicy): Record<string, string>;
/**
 * Cross-origin isolation header vocabulary.
 *
 * The single source of truth for the COOP/COEP pair czap emits so
 * `SharedArrayBuffer`-backed workers get cross-origin isolation. Both the emitter
 * (`@czap/astro`) and the deployed-header validator (`czap doctor --deployed`)
 * derive from here.
 *
 * @example
 * ```ts
 * import { CrossOriginIsolation } from '@czap/edge';
 *
 * const response = new Response(body, { headers: CrossOriginIsolation.isolationHeaders() });
 * // → Cross-Origin-Opener-Policy: same-origin
 * // → Cross-Origin-Embedder-Policy: require-corp
 * ```
 */
export declare const CrossOriginIsolation: {
    /** The isolating COOP value (`same-origin`). */
    readonly openerPolicy: typeof openerPolicy;
    /** The COEP values that establish isolation (`require-corp`, `credentialless`). */
    readonly embedderPolicies: typeof embedderPolicies;
    /** The COOP/COEP header pair czap emits, in emit order. */
    readonly isolationHeaders: typeof isolationHeaders;
};
export {};
//# sourceMappingURL=cross-origin.d.ts.map