@vorionsys/platform-core 0.1.0

package/dist/security/headers/types.d.ts

@@ -0,0 +1,1570 @@
+/**
+ * Security Headers Type Definitions
+ *
+ * Comprehensive type definitions and Zod schemas for security headers management.
+ * Includes CSP, HSTS, CORS, and Permissions Policy configurations.
+ *
+ * @packageDocumentation
+ * @module security/headers/types
+ */
+import { z } from 'zod';
+/**
+ * CSP source values
+ */
+export type CSPSourceValue = "'self'" | "'unsafe-inline'" | "'unsafe-eval'" | "'unsafe-hashes'" | "'strict-dynamic'" | "'report-sample'" | "'wasm-unsafe-eval'" | "'inline-speculation-rules'" | "'none'" | `'nonce-${string}'` | `'sha256-${string}'` | `'sha384-${string}'` | `'sha512-${string}'` | 'data:' | 'blob:' | 'mediastream:' | 'filesystem:' | string;
+/**
+ * CSP sandbox values
+ */
+export type CSPSandboxValue = 'allow-downloads' | 'allow-downloads-without-user-activation' | 'allow-forms' | 'allow-modals' | 'allow-orientation-lock' | 'allow-pointer-lock' | 'allow-popups' | 'allow-popups-to-escape-sandbox' | 'allow-presentation' | 'allow-same-origin' | 'allow-scripts' | 'allow-storage-access-by-user-activation' | 'allow-top-navigation' | 'allow-top-navigation-by-user-activation' | 'allow-top-navigation-to-custom-protocols';
+/**
+ * All CSP directives
+ */
+export interface CSPDirectives {
+    'default-src'?: CSPSourceValue[];
+    'child-src'?: CSPSourceValue[];
+    'connect-src'?: CSPSourceValue[];
+    'font-src'?: CSPSourceValue[];
+    'frame-src'?: CSPSourceValue[];
+    'img-src'?: CSPSourceValue[];
+    'manifest-src'?: CSPSourceValue[];
+    'media-src'?: CSPSourceValue[];
+    'object-src'?: CSPSourceValue[];
+    'prefetch-src'?: CSPSourceValue[];
+    'script-src'?: CSPSourceValue[];
+    'script-src-elem'?: CSPSourceValue[];
+    'script-src-attr'?: CSPSourceValue[];
+    'style-src'?: CSPSourceValue[];
+    'style-src-elem'?: CSPSourceValue[];
+    'style-src-attr'?: CSPSourceValue[];
+    'worker-src'?: CSPSourceValue[];
+    'base-uri'?: CSPSourceValue[];
+    sandbox?: CSPSandboxValue[];
+    'form-action'?: CSPSourceValue[];
+    'frame-ancestors'?: CSPSourceValue[];
+    'navigate-to'?: CSPSourceValue[];
+    'report-uri'?: string[];
+    'report-to'?: string;
+    'require-trusted-types-for'?: ('script')[];
+    'trusted-types'?: string[];
+    'upgrade-insecure-requests'?: boolean;
+    'block-all-mixed-content'?: boolean;
+}
+/**
+ * Zod schema for CSP source value
+ */
+export declare const cspSourceValueSchema: z.ZodString;
+/**
+ * Zod schema for CSP sandbox value
+ */
+export declare const cspSandboxValueSchema: z.ZodEnum<["allow-downloads", "allow-downloads-without-user-activation", "allow-forms", "allow-modals", "allow-orientation-lock", "allow-pointer-lock", "allow-popups", "allow-popups-to-escape-sandbox", "allow-presentation", "allow-same-origin", "allow-scripts", "allow-storage-access-by-user-activation", "allow-top-navigation", "allow-top-navigation-by-user-activation", "allow-top-navigation-to-custom-protocols"]>;
+/**
+ * Zod schema for CSP directives
+ */
+export declare const cspDirectivesSchema: z.ZodObject<{
+    'default-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'child-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'connect-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'font-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'frame-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'img-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'manifest-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'media-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'object-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'prefetch-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'script-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'script-src-elem': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'script-src-attr': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'style-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'style-src-elem': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'style-src-attr': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'worker-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'base-uri': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sandbox: z.ZodOptional<z.ZodArray<z.ZodEnum<["allow-downloads", "allow-downloads-without-user-activation", "allow-forms", "allow-modals", "allow-orientation-lock", "allow-pointer-lock", "allow-popups", "allow-popups-to-escape-sandbox", "allow-presentation", "allow-same-origin", "allow-scripts", "allow-storage-access-by-user-activation", "allow-top-navigation", "allow-top-navigation-by-user-activation", "allow-top-navigation-to-custom-protocols"]>, "many">>;
+    'form-action': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'frame-ancestors': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'navigate-to': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'report-uri': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'report-to': z.ZodOptional<z.ZodString>;
+    'require-trusted-types-for': z.ZodOptional<z.ZodArray<z.ZodLiteral<"script">, "many">>;
+    'trusted-types': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    'upgrade-insecure-requests': z.ZodOptional<z.ZodBoolean>;
+    'block-all-mixed-content': z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+    'upgrade-insecure-requests'?: boolean;
+    'default-src'?: string[];
+    'child-src'?: string[];
+    'connect-src'?: string[];
+    'font-src'?: string[];
+    'frame-src'?: string[];
+    'img-src'?: string[];
+    'manifest-src'?: string[];
+    'media-src'?: string[];
+    'object-src'?: string[];
+    'prefetch-src'?: string[];
+    'script-src'?: string[];
+    'script-src-elem'?: string[];
+    'script-src-attr'?: string[];
+    'style-src'?: string[];
+    'style-src-elem'?: string[];
+    'style-src-attr'?: string[];
+    'worker-src'?: string[];
+    'base-uri'?: string[];
+    'form-action'?: string[];
+    'frame-ancestors'?: string[];
+    'navigate-to'?: string[];
+    'report-uri'?: string[];
+    'report-to'?: string;
+    'require-trusted-types-for'?: "script"[];
+    'trusted-types'?: string[];
+    'block-all-mixed-content'?: boolean;
+}, {
+    sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+    'upgrade-insecure-requests'?: boolean;
+    'default-src'?: string[];
+    'child-src'?: string[];
+    'connect-src'?: string[];
+    'font-src'?: string[];
+    'frame-src'?: string[];
+    'img-src'?: string[];
+    'manifest-src'?: string[];
+    'media-src'?: string[];
+    'object-src'?: string[];
+    'prefetch-src'?: string[];
+    'script-src'?: string[];
+    'script-src-elem'?: string[];
+    'script-src-attr'?: string[];
+    'style-src'?: string[];
+    'style-src-elem'?: string[];
+    'style-src-attr'?: string[];
+    'worker-src'?: string[];
+    'base-uri'?: string[];
+    'form-action'?: string[];
+    'frame-ancestors'?: string[];
+    'navigate-to'?: string[];
+    'report-uri'?: string[];
+    'report-to'?: string;
+    'require-trusted-types-for'?: "script"[];
+    'trusted-types'?: string[];
+    'block-all-mixed-content'?: boolean;
+}>;
+/**
+ * HSTS Configuration
+ */
+export interface HSTSConfig {
+    /** Max-age in seconds (minimum 31536000 for preload) */
+    maxAge: number;
+    /** Include all subdomains */
+    includeSubDomains: boolean;
+    /** Enable preload (requires maxAge >= 31536000 and includeSubDomains) */
+    preload: boolean;
+}
+/**
+ * Minimum max-age for HSTS preload list submission (1 year in seconds)
+ */
+export declare const HSTS_MIN_MAX_AGE_FOR_PRELOAD = 31536000;
+/**
+ * Recommended max-age for HSTS (2 years in seconds)
+ */
+export declare const HSTS_RECOMMENDED_MAX_AGE = 63072000;
+/**
+ * Zod schema for HSTS configuration
+ */
+export declare const hstsConfigSchema: z.ZodEffects<z.ZodObject<{
+    maxAge: z.ZodDefault<z.ZodNumber>;
+    includeSubDomains: z.ZodDefault<z.ZodBoolean>;
+    preload: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    maxAge?: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+}, {
+    maxAge?: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+}>, {
+    maxAge?: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+}, {
+    maxAge?: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+}>;
+/**
+ * Validated CORS Configuration
+ *
+ * Unlike basic CORS config, this enforces security constraints:
+ * - No wildcard origins in production
+ * - Explicit allowed methods and headers
+ * - Validated credentials mode
+ */
+export interface CORSConfig {
+    /** Allowed origins (specific URLs, no wildcards in production) */
+    allowedOrigins: string[];
+    /** Allowed HTTP methods */
+    allowedMethods: string[];
+    /** Allowed request headers */
+    allowedHeaders: string[];
+    /** Headers exposed to the client */
+    exposedHeaders: string[];
+    /** Allow credentials (cookies, authorization headers) */
+    credentials: boolean;
+    /** Max age for preflight cache (seconds) */
+    maxAge: number;
+    /** Private network access (Access-Control-Allow-Private-Network) */
+    privateNetworkAccess: boolean;
+}
+/**
+ * Zod schema for CORS configuration
+ */
+export declare const corsConfigSchema: z.ZodEffects<z.ZodObject<{
+    allowedOrigins: z.ZodArray<z.ZodString, "many">;
+    allowedMethods: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    allowedHeaders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    exposedHeaders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    credentials: z.ZodDefault<z.ZodBoolean>;
+    maxAge: z.ZodDefault<z.ZodNumber>;
+    privateNetworkAccess: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    allowedOrigins?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+    allowedMethods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    privateNetworkAccess?: boolean;
+}, {
+    allowedOrigins?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+    allowedMethods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    privateNetworkAccess?: boolean;
+}>, {
+    allowedOrigins?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+    allowedMethods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    privateNetworkAccess?: boolean;
+}, {
+    allowedOrigins?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+    allowedMethods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    privateNetworkAccess?: boolean;
+}>;
+/**
+ * Permissions Policy feature value
+ */
+export type PermissionsPolicyValue = '*' | 'self' | '()' | `("${string}")` | `(self "${string}")` | string;
+/**
+ * Permissions Policy features
+ */
+export interface PermissionsPolicyConfig {
+    accelerometer?: PermissionsPolicyValue;
+    'ambient-light-sensor'?: PermissionsPolicyValue;
+    autoplay?: PermissionsPolicyValue;
+    battery?: PermissionsPolicyValue;
+    camera?: PermissionsPolicyValue;
+    'display-capture'?: PermissionsPolicyValue;
+    'document-domain'?: PermissionsPolicyValue;
+    'encrypted-media'?: PermissionsPolicyValue;
+    fullscreen?: PermissionsPolicyValue;
+    gamepad?: PermissionsPolicyValue;
+    geolocation?: PermissionsPolicyValue;
+    gyroscope?: PermissionsPolicyValue;
+    'hid'?: PermissionsPolicyValue;
+    'identity-credentials-get'?: PermissionsPolicyValue;
+    'idle-detection'?: PermissionsPolicyValue;
+    'local-fonts'?: PermissionsPolicyValue;
+    magnetometer?: PermissionsPolicyValue;
+    microphone?: PermissionsPolicyValue;
+    midi?: PermissionsPolicyValue;
+    'otp-credentials'?: PermissionsPolicyValue;
+    payment?: PermissionsPolicyValue;
+    'picture-in-picture'?: PermissionsPolicyValue;
+    'publickey-credentials-create'?: PermissionsPolicyValue;
+    'publickey-credentials-get'?: PermissionsPolicyValue;
+    'screen-wake-lock'?: PermissionsPolicyValue;
+    serial?: PermissionsPolicyValue;
+    'speaker-selection'?: PermissionsPolicyValue;
+    'storage-access'?: PermissionsPolicyValue;
+    usb?: PermissionsPolicyValue;
+    'web-share'?: PermissionsPolicyValue;
+    'window-management'?: PermissionsPolicyValue;
+    'xr-spatial-tracking'?: PermissionsPolicyValue;
+    'interest-cohort'?: PermissionsPolicyValue;
+}
+/**
+ * Zod schema for Permissions Policy value
+ */
+export declare const permissionsPolicyValueSchema: z.ZodString;
+/**
+ * Zod schema for Permissions Policy configuration
+ */
+export declare const permissionsPolicyConfigSchema: z.ZodObject<{
+    accelerometer: z.ZodOptional<z.ZodString>;
+    'ambient-light-sensor': z.ZodOptional<z.ZodString>;
+    autoplay: z.ZodOptional<z.ZodString>;
+    battery: z.ZodOptional<z.ZodString>;
+    camera: z.ZodOptional<z.ZodString>;
+    'display-capture': z.ZodOptional<z.ZodString>;
+    'document-domain': z.ZodOptional<z.ZodString>;
+    'encrypted-media': z.ZodOptional<z.ZodString>;
+    fullscreen: z.ZodOptional<z.ZodString>;
+    gamepad: z.ZodOptional<z.ZodString>;
+    geolocation: z.ZodOptional<z.ZodString>;
+    gyroscope: z.ZodOptional<z.ZodString>;
+    hid: z.ZodOptional<z.ZodString>;
+    'identity-credentials-get': z.ZodOptional<z.ZodString>;
+    'idle-detection': z.ZodOptional<z.ZodString>;
+    'local-fonts': z.ZodOptional<z.ZodString>;
+    magnetometer: z.ZodOptional<z.ZodString>;
+    microphone: z.ZodOptional<z.ZodString>;
+    midi: z.ZodOptional<z.ZodString>;
+    'otp-credentials': z.ZodOptional<z.ZodString>;
+    payment: z.ZodOptional<z.ZodString>;
+    'picture-in-picture': z.ZodOptional<z.ZodString>;
+    'publickey-credentials-create': z.ZodOptional<z.ZodString>;
+    'publickey-credentials-get': z.ZodOptional<z.ZodString>;
+    'screen-wake-lock': z.ZodOptional<z.ZodString>;
+    serial: z.ZodOptional<z.ZodString>;
+    'speaker-selection': z.ZodOptional<z.ZodString>;
+    'storage-access': z.ZodOptional<z.ZodString>;
+    usb: z.ZodOptional<z.ZodString>;
+    'web-share': z.ZodOptional<z.ZodString>;
+    'window-management': z.ZodOptional<z.ZodString>;
+    'xr-spatial-tracking': z.ZodOptional<z.ZodString>;
+    'interest-cohort': z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    payment?: string;
+    camera?: string;
+    accelerometer?: string;
+    'ambient-light-sensor'?: string;
+    autoplay?: string;
+    battery?: string;
+    'display-capture'?: string;
+    'document-domain'?: string;
+    'encrypted-media'?: string;
+    fullscreen?: string;
+    gamepad?: string;
+    geolocation?: string;
+    gyroscope?: string;
+    hid?: string;
+    'identity-credentials-get'?: string;
+    'idle-detection'?: string;
+    'local-fonts'?: string;
+    magnetometer?: string;
+    microphone?: string;
+    midi?: string;
+    'otp-credentials'?: string;
+    'picture-in-picture'?: string;
+    'publickey-credentials-create'?: string;
+    'publickey-credentials-get'?: string;
+    'screen-wake-lock'?: string;
+    serial?: string;
+    'speaker-selection'?: string;
+    'storage-access'?: string;
+    usb?: string;
+    'web-share'?: string;
+    'window-management'?: string;
+    'xr-spatial-tracking'?: string;
+    'interest-cohort'?: string;
+}, {
+    payment?: string;
+    camera?: string;
+    accelerometer?: string;
+    'ambient-light-sensor'?: string;
+    autoplay?: string;
+    battery?: string;
+    'display-capture'?: string;
+    'document-domain'?: string;
+    'encrypted-media'?: string;
+    fullscreen?: string;
+    gamepad?: string;
+    geolocation?: string;
+    gyroscope?: string;
+    hid?: string;
+    'identity-credentials-get'?: string;
+    'idle-detection'?: string;
+    'local-fonts'?: string;
+    magnetometer?: string;
+    microphone?: string;
+    midi?: string;
+    'otp-credentials'?: string;
+    'picture-in-picture'?: string;
+    'publickey-credentials-create'?: string;
+    'publickey-credentials-get'?: string;
+    'screen-wake-lock'?: string;
+    serial?: string;
+    'speaker-selection'?: string;
+    'storage-access'?: string;
+    usb?: string;
+    'web-share'?: string;
+    'window-management'?: string;
+    'xr-spatial-tracking'?: string;
+    'interest-cohort'?: string;
+}>;
+/**
+ * Cross-Origin Embedder Policy values
+ */
+export type COEPValue = 'unsafe-none' | 'require-corp' | 'credentialless';
+/**
+ * Cross-Origin Opener Policy values
+ */
+export type COOPValue = 'unsafe-none' | 'same-origin-allow-popups' | 'same-origin';
+/**
+ * Cross-Origin Resource Policy values
+ */
+export type CORPValue = 'same-site' | 'same-origin' | 'cross-origin';
+/**
+ * Referrer Policy values
+ */
+export type ReferrerPolicyValue = 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';
+/**
+ * X-Frame-Options values
+ */
+export type XFrameOptionsValue = 'DENY' | 'SAMEORIGIN';
+/**
+ * CSP Reporting configuration
+ */
+export interface CSPReportingConfig {
+    /** Report-URI endpoints (deprecated but still supported) */
+    reportUri?: string[];
+    /** Report-To group name */
+    reportTo?: string;
+    /** Reporting endpoint configuration */
+    reportingEndpoints?: Record<string, string>;
+}
+/**
+ * Complete Security Headers Configuration
+ */
+export interface SecurityHeadersConfig {
+    /** Environment mode for conditional strictness */
+    mode: 'production' | 'development' | 'testing';
+    /** Content Security Policy */
+    csp: {
+        enabled: boolean;
+        directives: CSPDirectives;
+        reportOnly: boolean;
+        reporting?: CSPReportingConfig;
+    };
+    /** HTTP Strict Transport Security */
+    hsts: {
+        enabled: boolean;
+        config: HSTSConfig;
+    };
+    /** Cross-Origin Resource Sharing */
+    cors: {
+        enabled: boolean;
+        config: CORSConfig;
+    };
+    /** Permissions Policy */
+    permissionsPolicy: {
+        enabled: boolean;
+        config: PermissionsPolicyConfig;
+    };
+    /** Cross-Origin Embedder Policy */
+    coep: {
+        enabled: boolean;
+        value: COEPValue;
+    };
+    /** Cross-Origin Opener Policy */
+    coop: {
+        enabled: boolean;
+        value: COOPValue;
+    };
+    /** Cross-Origin Resource Policy */
+    corp: {
+        enabled: boolean;
+        value: CORPValue;
+    };
+    /** Referrer Policy */
+    referrerPolicy: {
+        enabled: boolean;
+        value: ReferrerPolicyValue;
+    };
+    /** X-Frame-Options (legacy, prefer CSP frame-ancestors) */
+    xFrameOptions: {
+        enabled: boolean;
+        value: XFrameOptionsValue;
+    };
+    /** X-Content-Type-Options: nosniff */
+    xContentTypeOptions: {
+        enabled: boolean;
+    };
+    /** X-XSS-Protection (deprecated, set to 0) */
+    xXssProtection: {
+        enabled: boolean;
+    };
+    /** X-DNS-Prefetch-Control */
+    xDnsPrefetchControl: {
+        enabled: boolean;
+        value: 'on' | 'off';
+    };
+    /** X-Permitted-Cross-Domain-Policies */
+    xPermittedCrossDomainPolicies: {
+        enabled: boolean;
+        value: 'none' | 'master-only' | 'by-content-type' | 'all';
+    };
+    /** Paths to exclude from security headers */
+    excludePaths?: string[];
+}
+/**
+ * Zod schema for CSP reporting configuration
+ */
+export declare const cspReportingConfigSchema: z.ZodObject<{
+    reportUri: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    reportTo: z.ZodOptional<z.ZodString>;
+    reportingEndpoints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    reportUri?: string[];
+    reportTo?: string;
+    reportingEndpoints?: Record<string, string>;
+}, {
+    reportUri?: string[];
+    reportTo?: string;
+    reportingEndpoints?: Record<string, string>;
+}>;
+/**
+ * Zod schema for Security Headers Configuration
+ */
+export declare const securityHeadersConfigSchema: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<["production", "development", "testing"]>>;
+    csp: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        directives: z.ZodObject<{
+            'default-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'child-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'connect-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'font-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'frame-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'img-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'manifest-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'media-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'object-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'prefetch-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'script-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'script-src-elem': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'script-src-attr': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'style-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'style-src-elem': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'style-src-attr': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'worker-src': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'base-uri': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            sandbox: z.ZodOptional<z.ZodArray<z.ZodEnum<["allow-downloads", "allow-downloads-without-user-activation", "allow-forms", "allow-modals", "allow-orientation-lock", "allow-pointer-lock", "allow-popups", "allow-popups-to-escape-sandbox", "allow-presentation", "allow-same-origin", "allow-scripts", "allow-storage-access-by-user-activation", "allow-top-navigation", "allow-top-navigation-by-user-activation", "allow-top-navigation-to-custom-protocols"]>, "many">>;
+            'form-action': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'frame-ancestors': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'navigate-to': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'report-uri': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'report-to': z.ZodOptional<z.ZodString>;
+            'require-trusted-types-for': z.ZodOptional<z.ZodArray<z.ZodLiteral<"script">, "many">>;
+            'trusted-types': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            'upgrade-insecure-requests': z.ZodOptional<z.ZodBoolean>;
+            'block-all-mixed-content': z.ZodOptional<z.ZodBoolean>;
+        }, "strict", z.ZodTypeAny, {
+            sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+            'upgrade-insecure-requests'?: boolean;
+            'default-src'?: string[];
+            'child-src'?: string[];
+            'connect-src'?: string[];
+            'font-src'?: string[];
+            'frame-src'?: string[];
+            'img-src'?: string[];
+            'manifest-src'?: string[];
+            'media-src'?: string[];
+            'object-src'?: string[];
+            'prefetch-src'?: string[];
+            'script-src'?: string[];
+            'script-src-elem'?: string[];
+            'script-src-attr'?: string[];
+            'style-src'?: string[];
+            'style-src-elem'?: string[];
+            'style-src-attr'?: string[];
+            'worker-src'?: string[];
+            'base-uri'?: string[];
+            'form-action'?: string[];
+            'frame-ancestors'?: string[];
+            'navigate-to'?: string[];
+            'report-uri'?: string[];
+            'report-to'?: string;
+            'require-trusted-types-for'?: "script"[];
+            'trusted-types'?: string[];
+            'block-all-mixed-content'?: boolean;
+        }, {
+            sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+            'upgrade-insecure-requests'?: boolean;
+            'default-src'?: string[];
+            'child-src'?: string[];
+            'connect-src'?: string[];
+            'font-src'?: string[];
+            'frame-src'?: string[];
+            'img-src'?: string[];
+            'manifest-src'?: string[];
+            'media-src'?: string[];
+            'object-src'?: string[];
+            'prefetch-src'?: string[];
+            'script-src'?: string[];
+            'script-src-elem'?: string[];
+            'script-src-attr'?: string[];
+            'style-src'?: string[];
+            'style-src-elem'?: string[];
+            'style-src-attr'?: string[];
+            'worker-src'?: string[];
+            'base-uri'?: string[];
+            'form-action'?: string[];
+            'frame-ancestors'?: string[];
+            'navigate-to'?: string[];
+            'report-uri'?: string[];
+            'report-to'?: string;
+            'require-trusted-types-for'?: "script"[];
+            'trusted-types'?: string[];
+            'block-all-mixed-content'?: boolean;
+        }>;
+        reportOnly: z.ZodDefault<z.ZodBoolean>;
+        reporting: z.ZodOptional<z.ZodObject<{
+            reportUri: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            reportTo: z.ZodOptional<z.ZodString>;
+            reportingEndpoints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            reportUri?: string[];
+            reportTo?: string;
+            reportingEndpoints?: Record<string, string>;
+        }, {
+            reportUri?: string[];
+            reportTo?: string;
+            reportingEndpoints?: Record<string, string>;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        directives?: {
+            sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+            'upgrade-insecure-requests'?: boolean;
+            'default-src'?: string[];
+            'child-src'?: string[];
+            'connect-src'?: string[];
+            'font-src'?: string[];
+            'frame-src'?: string[];
+            'img-src'?: string[];
+            'manifest-src'?: string[];
+            'media-src'?: string[];
+            'object-src'?: string[];
+            'prefetch-src'?: string[];
+            'script-src'?: string[];
+            'script-src-elem'?: string[];
+            'script-src-attr'?: string[];
+            'style-src'?: string[];
+            'style-src-elem'?: string[];
+            'style-src-attr'?: string[];
+            'worker-src'?: string[];
+            'base-uri'?: string[];
+            'form-action'?: string[];
+            'frame-ancestors'?: string[];
+            'navigate-to'?: string[];
+            'report-uri'?: string[];
+            'report-to'?: string;
+            'require-trusted-types-for'?: "script"[];
+            'trusted-types'?: string[];
+            'block-all-mixed-content'?: boolean;
+        };
+        reportOnly?: boolean;
+        reporting?: {
+            reportUri?: string[];
+            reportTo?: string;
+            reportingEndpoints?: Record<string, string>;
+        };
+    }, {
+        enabled?: boolean;
+        directives?: {
+            sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+            'upgrade-insecure-requests'?: boolean;
+            'default-src'?: string[];
+            'child-src'?: string[];
+            'connect-src'?: string[];
+            'font-src'?: string[];
+            'frame-src'?: string[];
+            'img-src'?: string[];
+            'manifest-src'?: string[];
+            'media-src'?: string[];
+            'object-src'?: string[];
+            'prefetch-src'?: string[];
+            'script-src'?: string[];
+            'script-src-elem'?: string[];
+            'script-src-attr'?: string[];
+            'style-src'?: string[];
+            'style-src-elem'?: string[];
+            'style-src-attr'?: string[];
+            'worker-src'?: string[];
+            'base-uri'?: string[];
+            'form-action'?: string[];
+            'frame-ancestors'?: string[];
+            'navigate-to'?: string[];
+            'report-uri'?: string[];
+            'report-to'?: string;
+            'require-trusted-types-for'?: "script"[];
+            'trusted-types'?: string[];
+            'block-all-mixed-content'?: boolean;
+        };
+        reportOnly?: boolean;
+        reporting?: {
+            reportUri?: string[];
+            reportTo?: string;
+            reportingEndpoints?: Record<string, string>;
+        };
+    }>;
+    hsts: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        config: z.ZodEffects<z.ZodObject<{
+            maxAge: z.ZodDefault<z.ZodNumber>;
+            includeSubDomains: z.ZodDefault<z.ZodBoolean>;
+            preload: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        }, {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        }>, {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        }, {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        config?: {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        };
+    }, {
+        enabled?: boolean;
+        config?: {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        };
+    }>;
+    cors: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        config: z.ZodEffects<z.ZodObject<{
+            allowedOrigins: z.ZodArray<z.ZodString, "many">;
+            allowedMethods: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            allowedHeaders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            exposedHeaders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            credentials: z.ZodDefault<z.ZodBoolean>;
+            maxAge: z.ZodDefault<z.ZodNumber>;
+            privateNetworkAccess: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        }, {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        }>, {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        }, {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        config?: {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        };
+    }, {
+        enabled?: boolean;
+        config?: {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        };
+    }>;
+    permissionsPolicy: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        config: z.ZodObject<{
+            accelerometer: z.ZodOptional<z.ZodString>;
+            'ambient-light-sensor': z.ZodOptional<z.ZodString>;
+            autoplay: z.ZodOptional<z.ZodString>;
+            battery: z.ZodOptional<z.ZodString>;
+            camera: z.ZodOptional<z.ZodString>;
+            'display-capture': z.ZodOptional<z.ZodString>;
+            'document-domain': z.ZodOptional<z.ZodString>;
+            'encrypted-media': z.ZodOptional<z.ZodString>;
+            fullscreen: z.ZodOptional<z.ZodString>;
+            gamepad: z.ZodOptional<z.ZodString>;
+            geolocation: z.ZodOptional<z.ZodString>;
+            gyroscope: z.ZodOptional<z.ZodString>;
+            hid: z.ZodOptional<z.ZodString>;
+            'identity-credentials-get': z.ZodOptional<z.ZodString>;
+            'idle-detection': z.ZodOptional<z.ZodString>;
+            'local-fonts': z.ZodOptional<z.ZodString>;
+            magnetometer: z.ZodOptional<z.ZodString>;
+            microphone: z.ZodOptional<z.ZodString>;
+            midi: z.ZodOptional<z.ZodString>;
+            'otp-credentials': z.ZodOptional<z.ZodString>;
+            payment: z.ZodOptional<z.ZodString>;
+            'picture-in-picture': z.ZodOptional<z.ZodString>;
+            'publickey-credentials-create': z.ZodOptional<z.ZodString>;
+            'publickey-credentials-get': z.ZodOptional<z.ZodString>;
+            'screen-wake-lock': z.ZodOptional<z.ZodString>;
+            serial: z.ZodOptional<z.ZodString>;
+            'speaker-selection': z.ZodOptional<z.ZodString>;
+            'storage-access': z.ZodOptional<z.ZodString>;
+            usb: z.ZodOptional<z.ZodString>;
+            'web-share': z.ZodOptional<z.ZodString>;
+            'window-management': z.ZodOptional<z.ZodString>;
+            'xr-spatial-tracking': z.ZodOptional<z.ZodString>;
+            'interest-cohort': z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            payment?: string;
+            camera?: string;
+            accelerometer?: string;
+            'ambient-light-sensor'?: string;
+            autoplay?: string;
+            battery?: string;
+            'display-capture'?: string;
+            'document-domain'?: string;
+            'encrypted-media'?: string;
+            fullscreen?: string;
+            gamepad?: string;
+            geolocation?: string;
+            gyroscope?: string;
+            hid?: string;
+            'identity-credentials-get'?: string;
+            'idle-detection'?: string;
+            'local-fonts'?: string;
+            magnetometer?: string;
+            microphone?: string;
+            midi?: string;
+            'otp-credentials'?: string;
+            'picture-in-picture'?: string;
+            'publickey-credentials-create'?: string;
+            'publickey-credentials-get'?: string;
+            'screen-wake-lock'?: string;
+            serial?: string;
+            'speaker-selection'?: string;
+            'storage-access'?: string;
+            usb?: string;
+            'web-share'?: string;
+            'window-management'?: string;
+            'xr-spatial-tracking'?: string;
+            'interest-cohort'?: string;
+        }, {
+            payment?: string;
+            camera?: string;
+            accelerometer?: string;
+            'ambient-light-sensor'?: string;
+            autoplay?: string;
+            battery?: string;
+            'display-capture'?: string;
+            'document-domain'?: string;
+            'encrypted-media'?: string;
+            fullscreen?: string;
+            gamepad?: string;
+            geolocation?: string;
+            gyroscope?: string;
+            hid?: string;
+            'identity-credentials-get'?: string;
+            'idle-detection'?: string;
+            'local-fonts'?: string;
+            magnetometer?: string;
+            microphone?: string;
+            midi?: string;
+            'otp-credentials'?: string;
+            'picture-in-picture'?: string;
+            'publickey-credentials-create'?: string;
+            'publickey-credentials-get'?: string;
+            'screen-wake-lock'?: string;
+            serial?: string;
+            'speaker-selection'?: string;
+            'storage-access'?: string;
+            usb?: string;
+            'web-share'?: string;
+            'window-management'?: string;
+            'xr-spatial-tracking'?: string;
+            'interest-cohort'?: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        config?: {
+            payment?: string;
+            camera?: string;
+            accelerometer?: string;
+            'ambient-light-sensor'?: string;
+            autoplay?: string;
+            battery?: string;
+            'display-capture'?: string;
+            'document-domain'?: string;
+            'encrypted-media'?: string;
+            fullscreen?: string;
+            gamepad?: string;
+            geolocation?: string;
+            gyroscope?: string;
+            hid?: string;
+            'identity-credentials-get'?: string;
+            'idle-detection'?: string;
+            'local-fonts'?: string;
+            magnetometer?: string;
+            microphone?: string;
+            midi?: string;
+            'otp-credentials'?: string;
+            'picture-in-picture'?: string;
+            'publickey-credentials-create'?: string;
+            'publickey-credentials-get'?: string;
+            'screen-wake-lock'?: string;
+            serial?: string;
+            'speaker-selection'?: string;
+            'storage-access'?: string;
+            usb?: string;
+            'web-share'?: string;
+            'window-management'?: string;
+            'xr-spatial-tracking'?: string;
+            'interest-cohort'?: string;
+        };
+    }, {
+        enabled?: boolean;
+        config?: {
+            payment?: string;
+            camera?: string;
+            accelerometer?: string;
+            'ambient-light-sensor'?: string;
+            autoplay?: string;
+            battery?: string;
+            'display-capture'?: string;
+            'document-domain'?: string;
+            'encrypted-media'?: string;
+            fullscreen?: string;
+            gamepad?: string;
+            geolocation?: string;
+            gyroscope?: string;
+            hid?: string;
+            'identity-credentials-get'?: string;
+            'idle-detection'?: string;
+            'local-fonts'?: string;
+            magnetometer?: string;
+            microphone?: string;
+            midi?: string;
+            'otp-credentials'?: string;
+            'picture-in-picture'?: string;
+            'publickey-credentials-create'?: string;
+            'publickey-credentials-get'?: string;
+            'screen-wake-lock'?: string;
+            serial?: string;
+            'speaker-selection'?: string;
+            'storage-access'?: string;
+            usb?: string;
+            'web-share'?: string;
+            'window-management'?: string;
+            'xr-spatial-tracking'?: string;
+            'interest-cohort'?: string;
+        };
+    }>;
+    coep: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        value: z.ZodDefault<z.ZodEnum<["unsafe-none", "require-corp", "credentialless"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: "unsafe-none" | "require-corp" | "credentialless";
+        enabled?: boolean;
+    }, {
+        value?: "unsafe-none" | "require-corp" | "credentialless";
+        enabled?: boolean;
+    }>;
+    coop: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        value: z.ZodDefault<z.ZodEnum<["unsafe-none", "same-origin-allow-popups", "same-origin"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: "unsafe-none" | "same-origin-allow-popups" | "same-origin";
+        enabled?: boolean;
+    }, {
+        value?: "unsafe-none" | "same-origin-allow-popups" | "same-origin";
+        enabled?: boolean;
+    }>;
+    corp: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        value: z.ZodDefault<z.ZodEnum<["same-site", "same-origin", "cross-origin"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: "same-origin" | "same-site" | "cross-origin";
+        enabled?: boolean;
+    }, {
+        value?: "same-origin" | "same-site" | "cross-origin";
+        enabled?: boolean;
+    }>;
+    referrerPolicy: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        value: z.ZodDefault<z.ZodEnum<["no-referrer", "no-referrer-when-downgrade", "origin", "origin-when-cross-origin", "same-origin", "strict-origin", "strict-origin-when-cross-origin", "unsafe-url"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: "origin" | "same-origin" | "no-referrer" | "no-referrer-when-downgrade" | "origin-when-cross-origin" | "strict-origin" | "strict-origin-when-cross-origin" | "unsafe-url";
+        enabled?: boolean;
+    }, {
+        value?: "origin" | "same-origin" | "no-referrer" | "no-referrer-when-downgrade" | "origin-when-cross-origin" | "strict-origin" | "strict-origin-when-cross-origin" | "unsafe-url";
+        enabled?: boolean;
+    }>;
+    xFrameOptions: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        value: z.ZodDefault<z.ZodEnum<["DENY", "SAMEORIGIN"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: "DENY" | "SAMEORIGIN";
+        enabled?: boolean;
+    }, {
+        value?: "DENY" | "SAMEORIGIN";
+        enabled?: boolean;
+    }>;
+    xContentTypeOptions: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+    }, {
+        enabled?: boolean;
+    }>;
+    xXssProtection: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+    }, {
+        enabled?: boolean;
+    }>;
+    xDnsPrefetchControl: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        value: z.ZodDefault<z.ZodEnum<["on", "off"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: "on" | "off";
+        enabled?: boolean;
+    }, {
+        value?: "on" | "off";
+        enabled?: boolean;
+    }>;
+    xPermittedCrossDomainPolicies: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        value: z.ZodDefault<z.ZodEnum<["none", "master-only", "by-content-type", "all"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: "none" | "all" | "master-only" | "by-content-type";
+        enabled?: boolean;
+    }, {
+        value?: "none" | "all" | "master-only" | "by-content-type";
+        enabled?: boolean;
+    }>;
+    excludePaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    cors?: {
+        enabled?: boolean;
+        config?: {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        };
+    };
+    excludePaths?: string[];
+    mode?: "production" | "development" | "testing";
+    referrerPolicy?: {
+        value?: "origin" | "same-origin" | "no-referrer" | "no-referrer-when-downgrade" | "origin-when-cross-origin" | "strict-origin" | "strict-origin-when-cross-origin" | "unsafe-url";
+        enabled?: boolean;
+    };
+    csp?: {
+        enabled?: boolean;
+        directives?: {
+            sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+            'upgrade-insecure-requests'?: boolean;
+            'default-src'?: string[];
+            'child-src'?: string[];
+            'connect-src'?: string[];
+            'font-src'?: string[];
+            'frame-src'?: string[];
+            'img-src'?: string[];
+            'manifest-src'?: string[];
+            'media-src'?: string[];
+            'object-src'?: string[];
+            'prefetch-src'?: string[];
+            'script-src'?: string[];
+            'script-src-elem'?: string[];
+            'script-src-attr'?: string[];
+            'style-src'?: string[];
+            'style-src-elem'?: string[];
+            'style-src-attr'?: string[];
+            'worker-src'?: string[];
+            'base-uri'?: string[];
+            'form-action'?: string[];
+            'frame-ancestors'?: string[];
+            'navigate-to'?: string[];
+            'report-uri'?: string[];
+            'report-to'?: string;
+            'require-trusted-types-for'?: "script"[];
+            'trusted-types'?: string[];
+            'block-all-mixed-content'?: boolean;
+        };
+        reportOnly?: boolean;
+        reporting?: {
+            reportUri?: string[];
+            reportTo?: string;
+            reportingEndpoints?: Record<string, string>;
+        };
+    };
+    hsts?: {
+        enabled?: boolean;
+        config?: {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        };
+    };
+    permissionsPolicy?: {
+        enabled?: boolean;
+        config?: {
+            payment?: string;
+            camera?: string;
+            accelerometer?: string;
+            'ambient-light-sensor'?: string;
+            autoplay?: string;
+            battery?: string;
+            'display-capture'?: string;
+            'document-domain'?: string;
+            'encrypted-media'?: string;
+            fullscreen?: string;
+            gamepad?: string;
+            geolocation?: string;
+            gyroscope?: string;
+            hid?: string;
+            'identity-credentials-get'?: string;
+            'idle-detection'?: string;
+            'local-fonts'?: string;
+            magnetometer?: string;
+            microphone?: string;
+            midi?: string;
+            'otp-credentials'?: string;
+            'picture-in-picture'?: string;
+            'publickey-credentials-create'?: string;
+            'publickey-credentials-get'?: string;
+            'screen-wake-lock'?: string;
+            serial?: string;
+            'speaker-selection'?: string;
+            'storage-access'?: string;
+            usb?: string;
+            'web-share'?: string;
+            'window-management'?: string;
+            'xr-spatial-tracking'?: string;
+            'interest-cohort'?: string;
+        };
+    };
+    coep?: {
+        value?: "unsafe-none" | "require-corp" | "credentialless";
+        enabled?: boolean;
+    };
+    coop?: {
+        value?: "unsafe-none" | "same-origin-allow-popups" | "same-origin";
+        enabled?: boolean;
+    };
+    corp?: {
+        value?: "same-origin" | "same-site" | "cross-origin";
+        enabled?: boolean;
+    };
+    xFrameOptions?: {
+        value?: "DENY" | "SAMEORIGIN";
+        enabled?: boolean;
+    };
+    xContentTypeOptions?: {
+        enabled?: boolean;
+    };
+    xXssProtection?: {
+        enabled?: boolean;
+    };
+    xDnsPrefetchControl?: {
+        value?: "on" | "off";
+        enabled?: boolean;
+    };
+    xPermittedCrossDomainPolicies?: {
+        value?: "none" | "all" | "master-only" | "by-content-type";
+        enabled?: boolean;
+    };
+}, {
+    cors?: {
+        enabled?: boolean;
+        config?: {
+            allowedOrigins?: string[];
+            credentials?: boolean;
+            maxAge?: number;
+            allowedMethods?: string[];
+            allowedHeaders?: string[];
+            exposedHeaders?: string[];
+            privateNetworkAccess?: boolean;
+        };
+    };
+    excludePaths?: string[];
+    mode?: "production" | "development" | "testing";
+    referrerPolicy?: {
+        value?: "origin" | "same-origin" | "no-referrer" | "no-referrer-when-downgrade" | "origin-when-cross-origin" | "strict-origin" | "strict-origin-when-cross-origin" | "unsafe-url";
+        enabled?: boolean;
+    };
+    csp?: {
+        enabled?: boolean;
+        directives?: {
+            sandbox?: ("allow-downloads" | "allow-downloads-without-user-activation" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-storage-access-by-user-activation" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols")[];
+            'upgrade-insecure-requests'?: boolean;
+            'default-src'?: string[];
+            'child-src'?: string[];
+            'connect-src'?: string[];
+            'font-src'?: string[];
+            'frame-src'?: string[];
+            'img-src'?: string[];
+            'manifest-src'?: string[];
+            'media-src'?: string[];
+            'object-src'?: string[];
+            'prefetch-src'?: string[];
+            'script-src'?: string[];
+            'script-src-elem'?: string[];
+            'script-src-attr'?: string[];
+            'style-src'?: string[];
+            'style-src-elem'?: string[];
+            'style-src-attr'?: string[];
+            'worker-src'?: string[];
+            'base-uri'?: string[];
+            'form-action'?: string[];
+            'frame-ancestors'?: string[];
+            'navigate-to'?: string[];
+            'report-uri'?: string[];
+            'report-to'?: string;
+            'require-trusted-types-for'?: "script"[];
+            'trusted-types'?: string[];
+            'block-all-mixed-content'?: boolean;
+        };
+        reportOnly?: boolean;
+        reporting?: {
+            reportUri?: string[];
+            reportTo?: string;
+            reportingEndpoints?: Record<string, string>;
+        };
+    };
+    hsts?: {
+        enabled?: boolean;
+        config?: {
+            maxAge?: number;
+            includeSubDomains?: boolean;
+            preload?: boolean;
+        };
+    };
+    permissionsPolicy?: {
+        enabled?: boolean;
+        config?: {
+            payment?: string;
+            camera?: string;
+            accelerometer?: string;
+            'ambient-light-sensor'?: string;
+            autoplay?: string;
+            battery?: string;
+            'display-capture'?: string;
+            'document-domain'?: string;
+            'encrypted-media'?: string;
+            fullscreen?: string;
+            gamepad?: string;
+            geolocation?: string;
+            gyroscope?: string;
+            hid?: string;
+            'identity-credentials-get'?: string;
+            'idle-detection'?: string;
+            'local-fonts'?: string;
+            magnetometer?: string;
+            microphone?: string;
+            midi?: string;
+            'otp-credentials'?: string;
+            'picture-in-picture'?: string;
+            'publickey-credentials-create'?: string;
+            'publickey-credentials-get'?: string;
+            'screen-wake-lock'?: string;
+            serial?: string;
+            'speaker-selection'?: string;
+            'storage-access'?: string;
+            usb?: string;
+            'web-share'?: string;
+            'window-management'?: string;
+            'xr-spatial-tracking'?: string;
+            'interest-cohort'?: string;
+        };
+    };
+    coep?: {
+        value?: "unsafe-none" | "require-corp" | "credentialless";
+        enabled?: boolean;
+    };
+    coop?: {
+        value?: "unsafe-none" | "same-origin-allow-popups" | "same-origin";
+        enabled?: boolean;
+    };
+    corp?: {
+        value?: "same-origin" | "same-site" | "cross-origin";
+        enabled?: boolean;
+    };
+    xFrameOptions?: {
+        value?: "DENY" | "SAMEORIGIN";
+        enabled?: boolean;
+    };
+    xContentTypeOptions?: {
+        enabled?: boolean;
+    };
+    xXssProtection?: {
+        enabled?: boolean;
+    };
+    xDnsPrefetchControl?: {
+        value?: "on" | "off";
+        enabled?: boolean;
+    };
+    xPermittedCrossDomainPolicies?: {
+        value?: "none" | "all" | "master-only" | "by-content-type";
+        enabled?: boolean;
+    };
+}>;
+/**
+ * Security header validation severity
+ */
+export type ValidationSeverity = 'error' | 'warning' | 'info';
+/**
+ * Individual validation issue
+ */
+export interface ValidationIssue {
+    severity: ValidationSeverity;
+    header: string;
+    message: string;
+    recommendation?: string;
+}
+/**
+ * Validation result
+ */
+export interface HeaderValidationResult {
+    valid: boolean;
+    score: number;
+    maxScore: number;
+    grade: 'A+' | 'A' | 'B' | 'C' | 'D' | 'F';
+    issues: ValidationIssue[];
+    summary: {
+        errors: number;
+        warnings: number;
+        info: number;
+    };
+}
+/**
+ * Zod schema for validation issue
+ */
+export declare const validationIssueSchema: z.ZodObject<{
+    severity: z.ZodEnum<["error", "warning", "info"]>;
+    header: z.ZodString;
+    message: z.ZodString;
+    recommendation: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    message?: string;
+    recommendation?: string;
+    severity?: "error" | "info" | "warning";
+    header?: string;
+}, {
+    message?: string;
+    recommendation?: string;
+    severity?: "error" | "info" | "warning";
+    header?: string;
+}>;
+/**
+ * Zod schema for validation result
+ */
+export declare const headerValidationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    score: z.ZodNumber;
+    maxScore: z.ZodNumber;
+    grade: z.ZodEnum<["A+", "A", "B", "C", "D", "F"]>;
+    issues: z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<["error", "warning", "info"]>;
+        header: z.ZodString;
+        message: z.ZodString;
+        recommendation: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        message?: string;
+        recommendation?: string;
+        severity?: "error" | "info" | "warning";
+        header?: string;
+    }, {
+        message?: string;
+        recommendation?: string;
+        severity?: "error" | "info" | "warning";
+        header?: string;
+    }>, "many">;
+    summary: z.ZodObject<{
+        errors: z.ZodNumber;
+        warnings: z.ZodNumber;
+        info: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        info?: number;
+        errors?: number;
+        warnings?: number;
+    }, {
+        info?: number;
+        errors?: number;
+        warnings?: number;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    valid?: boolean;
+    issues?: {
+        message?: string;
+        recommendation?: string;
+        severity?: "error" | "info" | "warning";
+        header?: string;
+    }[];
+    maxScore?: number;
+    score?: number;
+    summary?: {
+        info?: number;
+        errors?: number;
+        warnings?: number;
+    };
+    grade?: "A" | "B" | "C" | "D" | "F" | "A+";
+}, {
+    valid?: boolean;
+    issues?: {
+        message?: string;
+        recommendation?: string;
+        severity?: "error" | "info" | "warning";
+        header?: string;
+    }[];
+    maxScore?: number;
+    score?: number;
+    summary?: {
+        info?: number;
+        errors?: number;
+        warnings?: number;
+    };
+    grade?: "A" | "B" | "C" | "D" | "F" | "A+";
+}>;
+/**
+ * CSP Violation Report (browser-sent format)
+ */
+export interface CSPViolationReport {
+    'csp-report': {
+        'document-uri': string;
+        'violated-directive': string;
+        'effective-directive': string;
+        'original-policy': string;
+        'blocked-uri': string;
+        'status-code': number;
+        'source-file'?: string;
+        'line-number'?: number;
+        'column-number'?: number;
+        'script-sample'?: string;
+        disposition?: 'enforce' | 'report';
+        referrer?: string;
+    };
+}
+/**
+ * Zod schema for CSP violation report
+ */
+export declare const cspViolationReportSchema: z.ZodObject<{
+    'csp-report': z.ZodObject<{
+        'document-uri': z.ZodString;
+        'violated-directive': z.ZodString;
+        'effective-directive': z.ZodString;
+        'original-policy': z.ZodString;
+        'blocked-uri': z.ZodString;
+        'status-code': z.ZodNumber;
+        'source-file': z.ZodOptional<z.ZodString>;
+        'line-number': z.ZodOptional<z.ZodNumber>;
+        'column-number': z.ZodOptional<z.ZodNumber>;
+        'script-sample': z.ZodOptional<z.ZodString>;
+        disposition: z.ZodOptional<z.ZodEnum<["enforce", "report"]>>;
+        referrer: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        referrer?: string;
+        'document-uri'?: string;
+        'violated-directive'?: string;
+        'effective-directive'?: string;
+        'original-policy'?: string;
+        'blocked-uri'?: string;
+        'status-code'?: number;
+        'source-file'?: string;
+        'line-number'?: number;
+        'column-number'?: number;
+        'script-sample'?: string;
+        disposition?: "enforce" | "report";
+    }, {
+        referrer?: string;
+        'document-uri'?: string;
+        'violated-directive'?: string;
+        'effective-directive'?: string;
+        'original-policy'?: string;
+        'blocked-uri'?: string;
+        'status-code'?: number;
+        'source-file'?: string;
+        'line-number'?: number;
+        'column-number'?: number;
+        'script-sample'?: string;
+        disposition?: "enforce" | "report";
+    }>;
+}, "strip", z.ZodTypeAny, {
+    'csp-report'?: {
+        referrer?: string;
+        'document-uri'?: string;
+        'violated-directive'?: string;
+        'effective-directive'?: string;
+        'original-policy'?: string;
+        'blocked-uri'?: string;
+        'status-code'?: number;
+        'source-file'?: string;
+        'line-number'?: number;
+        'column-number'?: number;
+        'script-sample'?: string;
+        disposition?: "enforce" | "report";
+    };
+}, {
+    'csp-report'?: {
+        referrer?: string;
+        'document-uri'?: string;
+        'violated-directive'?: string;
+        'effective-directive'?: string;
+        'original-policy'?: string;
+        'blocked-uri'?: string;
+        'status-code'?: number;
+        'source-file'?: string;
+        'line-number'?: number;
+        'column-number'?: number;
+        'script-sample'?: string;
+        disposition?: "enforce" | "report";
+    };
+}>;
+//# sourceMappingURL=types.d.ts.map