/**
 * Server-only: resolves `extensions.iframeImageSources` /
 * `extensions.iframeMediaSources` from app config. Kept out of
 * `html-shell.ts` because that shell is also built in the browser, where the
 * app-config store must not be imported.
 */
export declare function buildExtensionIframeMetaCsp(): string;
export interface ExtensionIframeDisplaySources {
    imageSources: string[];
    mediaSources: string[];
}
/**
 * The configured img-src / media-src lists for the client-rendered frames,
 * served at `EXTENSION_IFRAME_DISPLAY_SOURCES_PATH`. Validated through the same
 * CSP builder before they leave the server, and copied so the response cannot
 * alias the cached resolved config.
 */
export declare function getExtensionIframeDisplaySources(): ExtensionIframeDisplaySources;
/** The header CSP the render route sets: the meta CSP plus `frame-ancestors`. */
export declare function buildExtensionIframeCsp(): string;