import type { Connect, Plugin } from 'vite';
export declare const DEFAULT_PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=()";
type WindowAuthority = {
    label: string;
    backendCapabilities: readonly string[];
};
/** One private token shared by dev middleware and the native parent process. */
export declare function runtimeToken(): string;
export interface RuntimeSecurityOptions {
    /** Same `security.csp` value the app-shell plugin resolves the meta tag from — kept as one resolver (shell.ts's `resolveHeaderContentSecurityPolicy`) so dev's header and meta tag never drift. */
    csp?: string | false;
}
/** Protect dev loopback endpoints with native-issued, per-window authority. */
export declare function runtimeSecurityPlugin(windows: readonly WindowAuthority[], options?: RuntimeSecurityOptions): Plugin;
export declare function isAuthorizedNativeRequest(req: Connect.IncomingMessage, expectedToken: string): boolean;
/** Authenticate only; authorization is performed against the returned label. */
export declare function authorizedWindowLabel(req: Connect.IncomingMessage, expectedToken: string, allowQuery?: boolean): string | null;
/** Stable backend resource ID for the window allowlist. */
export declare function backendResourceForRequest(method: string, rawUrl: string): string | null;
export {};
//# sourceMappingURL=runtime-security.d.ts.map