import { Middleware } from "../types/http.js";
/**
 * Configuration options for security headers middleware
 */
export interface SecurityHeadersOptions {
    /**
     * Content Security Policy configuration
     * - false: Disable CSP header
     * - true: Use default CSP
     * - string: Custom CSP directives
     * @default "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';"
     */
    contentSecurityPolicy?: boolean | string;
    /**
     * Referrer-Policy header value
     * Controls how much referrer information is sent with requests
     * @default "strict-origin-when-cross-origin"
     */
    referrerPolicy?: string;
    /**
     * Permissions-Policy header value
     * Controls which browser features can be used
     * @default "geolocation=(), microphone=(), camera=()"
     */
    permissionsPolicy?: string;
    /**
     * HTTP Strict Transport Security (HSTS) configuration
     * Forces HTTPS connections for the specified duration
     */
    hsts?: {
        /**
         * Time in seconds to enforce HTTPS
         * @default 31536000 (1 year)
         */
        maxAge?: number;
        /**
         * Include all subdomains in HSTS policy
         * @default true
         */
        includeSubDomains?: boolean;
        /**
         * Submit site to browser HSTS preload list
         * @default false
         */
        preload?: boolean;
    };
    /**
     * X-Content-Type-Options: nosniff
     * Prevents MIME type sniffing
     * @default true
     */
    noSniff?: boolean;
    /**
     * X-XSS-Protection header
     * Enables browser XSS filtering
     * @default true
     */
    xssProtection?: boolean;
    /**
     * X-Frame-Options header
     * Prevents clickjacking attacks
     * - "DENY": No framing allowed
     * - "SAMEORIGIN": Only allow framing from same origin
     * - Custom value for specific origins
     * @default "DENY"
     */
    frameOptions?: "DENY" | "SAMEORIGIN" | string;
    /**
     * Cross-Origin-Embedder-Policy header
     * Controls loading of cross-origin resources
     * @default "require-corp"
     */
    crossOriginEmbedderPolicy?: string;
    /**
     * Cross-Origin-Opener-Policy header
     * Isolates browsing context from cross-origin windows
     * @default "same-origin"
     */
    crossOriginOpenerPolicy?: string;
    /**
     * Cross-Origin-Resource-Policy header
     * Controls sharing of resources across origins
     * @default "same-origin"
     */
    crossOriginResourcePolicy?: string;
}
/**
 * Creates a comprehensive security headers middleware.
 *
 * This middleware sets various HTTP security headers to protect against common web vulnerabilities:
 * - XSS attacks (Content Security Policy, X-XSS-Protection)
 * - Clickjacking (X-Frame-Options)
 * - MIME type sniffing (X-Content-Type-Options)
 * - Information leakage (Referrer-Policy)
 * - HTTPS enforcement (HSTS)
 * - Feature policy restrictions (Permissions-Policy)
 *
 * @param options - Configuration options for security headers
 * @returns A middleware function that sets security headers
 *
 * @example
 * ```typescript
 * import { createSecurityHeadersMiddleware } from "reiatsu";
 *
 * // Use default secure settings
 * app.use(createSecurityHeadersMiddleware());
 *
 * // Custom configuration
 * app.use(createSecurityHeadersMiddleware({
 *   contentSecurityPolicy: "default-src 'self'; script-src 'self' 'unsafe-inline' cdn.example.com",
 *   hsts: {
 *     maxAge: 63072000,      // 2 years
 *     includeSubDomains: true,
 *     preload: true
 *   },
 *   frameOptions: "SAMEORIGIN",
 *   permissionsPolicy: "geolocation=(), camera=()"
 * }));
 *
 * // Disable specific headers
 * app.use(createSecurityHeadersMiddleware({
 *   contentSecurityPolicy: false,  // Disable CSP
 *   xssProtection: false            // Disable X-XSS-Protection
 * }));
 * ```
 *
 * @remarks
 * - HSTS is only set for HTTPS connections
 * - CSP can break functionality if too restrictive - test thoroughly
 * - For production, consider enabling HSTS preload
 * - Some headers may not be supported by older browsers
 */
export declare const createSecurityHeadersMiddleware: (options?: SecurityHeadersOptions) => Middleware;
/**
 * Convenience middleware with default secure settings
 *
 * @example
 * ```typescript
 * import { securityHeadersMiddleware } from "reiatsu";
 *
 * app.use(securityHeadersMiddleware);
 * ```
 */
export declare const securityHeadersMiddleware: Middleware;
//# sourceMappingURL=security.d.ts.map