import './assert_dev_env.js';
import type { z } from 'zod';
import { type TestMiddlewareStackOptions } from './middleware.js';
/** A header-level attack case for middleware stack testing. */
export interface AdversarialHeaderCase {
    name: string;
    headers: Record<string, string>;
    expected_status: number;
    expected_error?: string;
    /** Zod schema to validate error response body against. Defaults to `ApiError` when `expected_error` is set. */
    expected_error_schema?: z.ZodType;
    /** Whether the request should reach token validation or be short-circuited by earlier middleware. */
    validate_expectation: 'called' | 'not_called';
}
/**
 * 7 standard adversarial header cases applicable to any middleware stack.
 *
 * Origin verification is Origin-only — fuz_app's `verify_request_source`
 * no longer falls back to `Referer` (matches `zzz_server::auth::is_request_origin_allowed`).
 * Bearer auth still treats a `Referer` header as a browser-context
 * indicator and silently discards the bearer token — so Referer-bearing
 * requests reach the route as unauthenticated rather than 403.
 *
 * @param allowed_origin - an origin that passes the origin check
 */
export declare const create_standard_adversarial_cases: (allowed_origin: string) => Array<AdversarialHeaderCase>;
/**
 * Create a middleware stack app with standard adversarial header tests.
 *
 * Convenience wrapper combining `create_test_middleware_stack_app`
 * and `create_standard_adversarial_cases`. Generates one `test()` per case
 * inside a `describe()` block — asserts body content for both error and
 * success cases, and verifies that `mock_validate` was (or was not) reached
 * per the case's `validate_expectation` flag, ensuring earlier middleware
 * actually short-circuits before token validation in the rejection cases.
 *
 * @param suite_name - the describe block name
 * @param options - middleware stack configuration
 * @param allowed_origin - an origin that passes the origin check (used for standard cases)
 * @param extra_cases - additional cases appended after the 7 standard ones
 */
export declare const describe_standard_adversarial_headers: (suite_name: string, options: TestMiddlewareStackOptions, allowed_origin: string, extra_cases?: Array<AdversarialHeaderCase>) => void;
//# sourceMappingURL=adversarial_headers.d.ts.map