import type { SecurityHeadersConfig } from "../config/index.js";
/** Default security headers applied when `security.headers` is not `false`. */
export declare const DEFAULT_SECURITY_HEADERS: Required<Omit<SecurityHeadersConfig, "contentSecurityPolicy" | "hsts" | "permissionsPolicy">>;
/**
 * Builds the security headers map from the resolved config.
 * Returns an empty map if headers are disabled.
 */
export declare function buildSecurityHeaders(config: SecurityHeadersConfig | false, isHttps: boolean, nonce?: string): Record<string, string>;
/**
 * Applies security headers to an existing Response, preserving any
 * user-set headers unless overridden by security config.
 */
export declare function applySecurityHeaders(response: Response, headers: Record<string, string>): Response;