type OriginMatcher = string | RegExp;
type CorsOptions = {
    /**
     * Which origins are allowed to make cross-origin requests.
     * - `true`  → reflect any origin (echoes back the request's `Origin`).
     * - `false` → CORS disabled; every cross-origin request is denied.
     * - string  → exact match against the request's `Origin`.
     * - RegExp  → pattern match.
     * - Array   → any-of match against the entries.
     * - Function → sync or async predicate; return true (or resolve to true) to allow.
     * When the predicate is async, `check()` returns a Promise<CorsDecision>;
     * for sync predicates it stays sync so consumers pay no async cost.
     */
    origin?: boolean | OriginMatcher | OriginMatcher[] | ((origin: string | undefined) => boolean | Promise<boolean>) | undefined;
    /**
     * Comma-separated string or array. Default:
     * `['GET','HEAD','PUT','PATCH','POST','DELETE']`. Sent as
     * `Access-Control-Allow-Methods` on preflight only.
     */
    methods?: string | string[] | undefined;
    /**
     * Headers the browser may include on the actual request. Default `true` =
     * echo the request's `Access-Control-Request-Headers`. Sent on preflight.
     */
    allowedHeaders?: string | true | string[] | undefined;
    /**
     * Response headers the browser may read via `getResponseHeader()`. Sent
     * on the actual response.
     */
    exposedHeaders?: string | string[] | undefined;
    /**
     * When true, sets `Access-Control-Allow-Credentials: true`. Requires an
     * exact-echoed origin — cannot be combined with the `*` wildcard.
     */
    credentials?: boolean | undefined;
    /**
     * Seconds the browser may cache the preflight decision. Sent on preflight.
     */
    maxAge?: number | undefined;
    /**
     * HTTP status to end a preflight response with. Some legacy setups need
     * 200 instead — Chrome accepts either.
     */
    optionsSuccessStatus?: number | undefined;
};

type CspOptions = {
    directives?: Record<string, false | string[]> | undefined;
    useDefaults?: boolean | undefined;
    reportOnly?: boolean | undefined;
};
type HstsOptions = {
    /**
     * Seconds. Default 180 days.
     */
    maxAge?: number | undefined;
    includeSubDomains?: boolean | undefined;
    /**
     * Requires maxAge >= 1y + includeSubDomains.
     */
    preload?: boolean | undefined;
};
type FrameguardOptions = "DENY" | "SAMEORIGIN" | {
    action: "DENY" | "SAMEORIGIN";
};
type PermissionsPolicyOptions = {
    features?: Record<string, string[]> | undefined;
};
/**
 * A static-value policy option:
 *   true → default value, false → skip,
 *   string / { value } → verbatim override.
 */
type StaticHeaderOption = boolean | string | {
    value: string;
} | undefined;
type HeadersOptions = {
    contentSecurityPolicy?: boolean | CspOptions | undefined;
    hsts?: boolean | HstsOptions | undefined;
    /**
     * Alias of `hsts`.
     */
    strictTransportSecurity?: boolean | HstsOptions | undefined;
    contentTypeOptions?: StaticHeaderOption;
    dnsPrefetchControl?: StaticHeaderOption;
    downloadOptions?: StaticHeaderOption;
    permittedCrossDomainPolicies?: StaticHeaderOption;
    originAgentCluster?: StaticHeaderOption;
    xssProtection?: StaticHeaderOption;
    crossOriginOpenerPolicy?: StaticHeaderOption;
    crossOriginEmbedderPolicy?: StaticHeaderOption;
    crossOriginResourcePolicy?: StaticHeaderOption;
    referrerPolicy?: StaticHeaderOption;
    frameguard?: boolean | FrameguardOptions | undefined;
    permissionsPolicy?: boolean | PermissionsPolicyOptions | undefined;
};

type CsrfMiddlewareOptions = {
    /**
     * Minimum 32 bytes of entropy.
     */
    secret: string | Buffer;
    cookieName?: string | undefined;
    headerName?: string | undefined;
    /**
     * Form body field name. Defaults to
     *            `cookieName`, but overriding lets
     *            you decouple cookie naming from the
     *            `<input name="…">` your templates use.
     */
    formField?: string | undefined;
    ignoreMethods?: string[] | undefined;
    /**
     * Overrides for the Set-Cookie flags.
     */
    cookieOptions?: object | undefined;
    tokenFromRequest?: ((req: unknown) => string | undefined) | undefined;
};
type RateLimitMiddlewareOptions = {
    limiter: {
        check: Function;
    };
    keyGenerator?: ((req: unknown) => string | undefined) | undefined;
    onDenied?: ((req: unknown, res: unknown, result: object) => unknown) | undefined;
    /**
     * Whether the default key generator may read the client IP from the
     * `X-Forwarded-For` header. That header is client-controlled, so trusting
     * it without a proxy in front lets an attacker rotate it to mint unlimited
     * rate-limit buckets (limit bypass) or spoof another user's IP. Leave
     * `false` unless your app sits behind a proxy/CDN that overwrites XFF.
     * Ignored when `keyGenerator` is supplied. (Express adapter uses `req.ip`,
     * which already honours the framework's own `trust proxy` setting.)
     */
    trustProxy?: boolean | undefined;
};
type SecurityMiddlewareOptions = {
    headers?: boolean | HeadersOptions | undefined;
    cors?: false | CorsOptions | undefined;
    csrf?: false | CsrfMiddlewareOptions | undefined;
    rateLimit?: false | RateLimitMiddlewareOptions | undefined;
};

/** Only-headers middleware. */
declare function headersMiddleware(options: any): (req: any, res: any, next: any) => Promise<void>;
/** Only-CORS middleware. */
declare function corsMiddleware(options: any): (req: any, res: any, next: any) => Promise<void>;
/** Only-CSRF middleware. */
declare function csrfMiddleware(options: any): (req: any, res: any, next: any) => Promise<void>;
/** Only rate-limit middleware. */
declare function rateLimitMiddleware(options: any): (req: any, res: any, next: any) => Promise<void>;
/**
 * Umbrella middleware — headers + cors + csrf + rate-limit in one `app.use`.
 * Each concern is opt-in; set to `false` to skip. See the individual
 * factories above if you want to compose them yourself.
 *
 * @param {import('./core.js').SecurityMiddlewareOptions} options
 */
declare function securityMiddleware(options?: SecurityMiddlewareOptions): (req: any, res: any, next: any) => Promise<void>;

export { corsMiddleware, csrfMiddleware, securityMiddleware as default, headersMiddleware, rateLimitMiddleware, securityMiddleware };