import type { RuntimeAdapter } from "../../platform/adapters/base.js";
import type { SecurityConfig } from "../../types/index.js";
import type { VeryfrontConfig } from "../../config/index.js";
export interface DerivedSecurityContext {
    securityConfig: SecurityConfig;
}
export interface DeriveSecurityContextOptions {
    /**
     * The caller's runtime classification.
     *
     * Security defaults no longer vary by environment: `security.csrf` resolves
     * the same way everywhere so a mutation that works locally works after
     * deploy. The option remains accepted, and validated, because callers pass
     * it and an unrecognised or hostile option shape must still fail closed.
     */
    productionDefaults?: boolean;
    /**
     * Origins derived from the project's released source. Platform-supplied;
     * anything a project config carries under this name is discarded.
     */
    derivedCsp?: SecurityConfig["derivedCsp"];
}
/**
 * Check a standalone security configuration against the canonical project
 * configuration schema.
 *
 * @deprecated Project configuration loaded through `getConfig()` is already
 * validated. Prefer that validated configuration or `SecurityConfigLoader`.
 */
export declare function isValidSecurityConfig(config: unknown): config is SecurityConfig;
/**
 * Load the project's schema-validated security configuration.
 *
 * Unlike the historical implementation, configuration loading and validation
 * failures are propagated so callers cannot silently continue without the
 * configured security policy. `null` means that the project has no security
 * configuration.
 *
 * @deprecated Use `SecurityConfigLoader` to derive the runtime security
 * context, including production defaults and the serialized CSP header.
 */
export declare function loadSecurityConfig(projectDir: string, adapter: RuntimeAdapter): Promise<SecurityConfig | null>;
/**
 * Derive a request-owned security context from schema-validated project config.
 *
 * Config objects can be cached and shared between projects or requests. Deep
 * cloning and freezing here prevents a handler from mutating that shared
 * source. Function-valued origin validators are wrapped in request-owned
 * frozen callables so mutable function objects are not shared across requests.
 */
export declare function deriveSecurityContext(cfg?: VeryfrontConfig, options?: DeriveSecurityContextOptions): DerivedSecurityContext;
export declare class SecurityConfigLoader {
    private projectDir;
    private adapter;
    private configOverride?;
    private productionRuntime;
    private securityConfig;
    private isLoaded;
    private loadPromise;
    constructor(projectDir: string, adapter: RuntimeAdapter, configOverride?: VeryfrontConfig | undefined, productionRuntime?: boolean);
    ensureLoaded(): Promise<void>;
    private load;
    private applyConfig;
    getSecurityConfig(): SecurityConfig | null;
    getCorsConfig(): SecurityConfig["cors"];
    buildCsp(isDev: boolean, nonce?: string): string;
    getSecurityHeader(headerName: string, defaultValue: string): string;
}
//# sourceMappingURL=config.d.ts.map