/**
 * Content Security Policy (CSP) Middleware
 *
 * Sets CSP headers based on deployment configuration.
 * Configured via `frontmcp.config` server.csp settings,
 * injected as environment variables at build time.
 */
/**
 * CSP configuration read from environment variables (set by build adapter).
 */
export interface CspOptions {
    /** Enable CSP headers. */
    enabled: boolean;
    /** CSP directives map. */
    directives: Record<string, string>;
    /** Report URI for violations. */
    reportUri?: string;
    /** Use Report-Only header instead of enforcement. */
    reportOnly: boolean;
}
/**
 * Read CSP configuration from environment variables.
 * Environment variables are injected by the build adapter from frontmcp.config.
 *
 * FRONTMCP_CSP_ENABLED=1
 * FRONTMCP_CSP_DIRECTIVES=default-src 'self'; script-src 'self' https://cdn.example.com
 * FRONTMCP_CSP_REPORT_URI=https://report.example.com/csp
 * FRONTMCP_CSP_REPORT_ONLY=1
 */
export declare function readCspFromEnv(): CspOptions | undefined;
/**
 * Build the CSP header value from directives.
 */
export declare function buildCspHeaderValue(options: CspOptions): string;
/**
 * Get the CSP header name based on report-only mode.
 */
export declare function getCspHeaderName(reportOnly: boolean): string;
/**
 * Security headers read from environment variables.
 * Set by the build adapter from frontmcp.config server.headers settings.
 *
 * FRONTMCP_HSTS=max-age=31536000; includeSubDomains
 * FRONTMCP_CONTENT_TYPE_OPTIONS=nosniff
 * FRONTMCP_FRAME_OPTIONS=DENY
 */
export interface SecurityHeaders {
    hsts?: string;
    contentTypeOptions?: string;
    frameOptions?: string;
    custom?: Record<string, string>;
}
/**
 * Read security headers from environment variables.
 */
export declare function readSecurityHeadersFromEnv(): SecurityHeaders;
/**
 * Apply security headers to a response object.
 * Called by the HTTP adapter on every response.
 */
export declare function applySecurityHeaders(res: {
    setHeader(name: string, value: string): void;
}, headers: SecurityHeaders, csp?: CspOptions): void;
//# sourceMappingURL=csp.middleware.d.ts.map