/**
 * Apply the default security headers to a Headers instance in-place.
 *
 * Headers applied unconditionally (cheap, no compat risk):
 * - `X-Content-Type-Options: nosniff` — blocks MIME-sniff XSS
 * - `X-Frame-Options: SAMEORIGIN` — clickjacking protection (CSP
 *   `frame-ancestors` is the modern equivalent but XFO still ships)
 * - `Referrer-Policy: strict-origin-when-cross-origin` — modern default
 *
 * Production-only:
 * - `Strict-Transport-Security: max-age=31536000; includeSubDomains` —
 *   tells browsers to commit to HTTPS for a year. Omits `preload` since
 *   that's an irreversible commitment to the browser preload list.
 *
 * Skips overwriting any header that's already set — explicit userland
 * config wins. Skips entirely when `STACKS_SECURITY_HEADERS_DISABLE=true`.
 */
export declare function applySecurityHeaders(headers: Headers): void;
/** Test helper — reset the cached env-derived flags. */
export declare function __resetSecurityHeadersCache(): void;