import type { RuntimeAdapter } from "../../../platform/adapters/base.js";
import type { SecurityConfig } from "./types.js";
/**
 * Response headers whose values and omissions are owned by the centralized
 * security policy. Server integrations must remove project-provided values
 * before applying policy so development omissions remain authoritative.
 */
export declare const SECURITY_POLICY_RESPONSE_HEADER_NAMES: readonly ["content-security-policy", "content-security-policy-report-only", "cross-origin-embedder-policy", "cross-origin-opener-policy", "cross-origin-resource-policy", "referrer-policy", "reporting-endpoints", "strict-transport-security", "x-content-type-options", "x-frame-options", "x-xss-protection"];
export declare function generateNonce(): string;
/**
 * Build the served policy: the platform floor with project sources merged in.
 *
 * The floor is enforced, not opt-in — hosting means a project that never
 * configures anything still gets a baseline. Project configuration can only
 * add to it, or drop the baseline class of a directive with `null`. Producing
 * a policy that omits required sources needs `VERYFRONT_CSP`, an ops-level
 * decision that is deliberately unreachable from project config.
 */
export declare function buildCSP(isDev: boolean, nonce: string, config?: SecurityConfig | null, adapter?: RuntimeAdapter, isVeryfrontDomain?: boolean): string;
/**
 * The enforced companion to the reported floor.
 *
 * Carries the always-enforced directives, the hosted Studio embedding policy,
 * every directive the project declared, and then whatever those would
 * otherwise absorb through CSP's fallback chain. Declaring a directive is
 * taken as meaning it -- a project that lists its image origins wants `img-src`
 * to hold -- while directives it never mentioned keep reporting rather than
 * binding. That is the difference between honouring a project's configuration
 * and inferring, from one image origin, that it also wants `script-src` bound
 * across the site.
 *
 * Values come from the same merged policy the reported header carries, so a
 * directive pulled in by fallback is enforced exactly as it was reported.
 *
 * @returns the enforced policy, or "" when the full policy already binds
 */
export declare function buildEnforcedCSP(isDev: boolean, nonce: string, config?: SecurityConfig | null, isVeryfrontDomain?: boolean, hasEnvOverride?: boolean): string;
export declare function getSecurityHeader(headerName: string, defaultValue: string, config?: SecurityConfig | null, adapter?: RuntimeAdapter): string;
export declare function applySecurityHeaders(headers: Headers, isDev: boolean, nonce: string, config?: SecurityConfig | null, adapter?: RuntimeAdapter, isVeryfrontDomain?: boolean): void;
//# sourceMappingURL=security-handler.d.ts.map