/**
 * Normalise `config.server.security.embeddable` into the rules the
 * per-response check reads.
 *
 * Resolved once at boot, mirroring `resolveApiProxyRules`: `@stacksjs/config`
 * populates overrides asynchronously, so a per-request read would answer
 * differently depending on how far boot had progressed.
 *
 * An entry ending in `/` is a prefix; anything else is an exact path.
 */
export declare function resolveEmbeddableRules(input?: readonly string[]): EmbeddableRules;
/** Whether this path is one the app said another origin may frame. */
export declare function isEmbeddablePath(pathname: string, rules: EmbeddableRules): boolean;
/**
 * Stamp the view security headers onto a response.
 *
 * Mutates `response.headers` in place and returns `undefined`, so a caller
 * that has nothing else to change can leave the original response alone.
 * A response with immutable headers (a `Response.redirect()`, for instance)
 * cannot be mutated, so it is rebuilt and returned - the same shape
 * `stacks-router.ts` already uses for this case.
 *
 * Never overwrites a header that is already set: an app that set its own
 * `X-Frame-Options` in a template or a proxy has said something more
 * specific.
 */
export declare function applyViewSecurityHeaders(req: Request, response: Response, rules: EmbeddableRules): Response | undefined;
/** Test helper - reset the cached env-derived flag. */
export declare function __resetViewSecurityHeadersCache(): void;
/** Paths another origin is allowed to frame. */
export declare interface EmbeddableRules {
  paths: string[]
  prefixes: string[]
}