import type { Plugin } from './app';
/** Options for {@link securityHeaders}. Each header defaults on; `false` omits it. */
export interface SecurityHeadersOptions {
    /** `Content-Security-Policy`. Default `default-src 'self'`. */
    contentSecurityPolicy?: string | false;
    /** `Strict-Transport-Security`. Default `max-age=15552000; includeSubDomains`. */
    strictTransportSecurity?: string | false;
    /** `X-Frame-Options`. Default `DENY`. */
    frameOptions?: string | false;
    /** `Referrer-Policy`. Default `no-referrer`. */
    referrerPolicy?: string | false;
    /** `Cross-Origin-Opener-Policy`. Default `same-origin`. */
    crossOriginOpenerPolicy?: string | false;
    /** `X-Content-Type-Options: nosniff`. Default `true`. */
    contentTypeOptions?: boolean;
}
/**
 * Plugin: set a baseline of security response headers (a helmet-style default) —
 * `Content-Security-Policy`, `Strict-Transport-Security`, `X-Frame-Options`,
 * `Referrer-Policy`, `Cross-Origin-Opener-Policy`, and `X-Content-Type-Options`.
 * Each is overridable, or `false` to omit it. Applied to every response without
 * clobbering a header a handler already set.
 *
 * ```ts
 * const app = await createApp({ plugins: [securityHeaders()] })
 * ```
 *
 * @param options - per-header overrides, or `false` to omit a given header
 * @returns a plugin that sets the baseline security response headers
 */
export declare function securityHeaders(options?: SecurityHeadersOptions): Plugin;
//# sourceMappingURL=security-headers.d.ts.map