/**
 * CSP Violation Report Handler
 *
 * Receives the reports the platform CSP asks browsers to send, and writes them
 * to the server log.
 *
 * Without this the report-only floor is inert at the platform level: it does
 * not enforce, so it protects nothing, and with no reporting endpoint the
 * violations it names reach only whoever happens to open devtools on the
 * affected page. That leaves the enforcement rollout with no instrument --
 * no way to answer "which projects would break if we enforced?" short of
 * breaking them and waiting for complaints, which is how the floor shipped
 * the first time.
 *
 * Endpoint: POST /_vf/csp-report
 */
import { BaseHandler } from "../response/base.js";
import type { HandlerContext, HandlerMetadata, HandlerResult } from "../types.js";
export interface NormalizedViolation {
    documentUri?: string;
    effectiveDirective?: string;
    blockedUri?: string;
    disposition?: string;
    statusCode?: number;
}
/**
 * Two wire formats reach this path and both are still in the field: the legacy
 * `application/csp-report` body with a single `csp-report` key, and the
 * Reporting API's `application/reports+json` array. Normalize to one shape so
 * the log has a single schema regardless of which browser sent it.
 */
export declare function normalizeReports(payload: unknown): NormalizedViolation[];
/**
 * Per-window budget for log records.
 *
 * Charged per record rather than per request: one admission covering a whole
 * batch would let a sender post {@link MAX_REPORTS_PER_REQUEST} violations at a
 * time and write 16x the ceiling. The endpoint is unauthenticated, so this bound
 * is the only thing protecting the log stream.
 *
 * Separate from the handler so the arithmetic can be tested as arithmetic,
 * rather than by intercepting log output.
 */
export declare function createLogWindow(maxPerWindow?: number, windowMs?: number): {
    /** @returns how many of `lines` may be written, and what the previous window swallowed */
    reserve: (now: number, lines: number) => {
        allowed: number;
        dropped: number;
    };
};
export declare class CspReportHandler extends BaseHandler {
    #private;
    metadata: HandlerMetadata;
    handle(req: Request, ctx: HandlerContext): Promise<HandlerResult>;
}
//# sourceMappingURL=csp-report.handler.d.ts.map