/** Escapes `& < > " '` — safe for text nodes and quoted attribute values. */
export declare function escapeHtml(value: unknown): string;
/**
 * `JSON.stringify` a value so it can be embedded inside an inline `<script>`
 * element without a crafted string (`"</script><svg onload=…>"`) terminating
 * the block early.
 */
export declare function scriptJson(value: unknown): string;
export interface PageCspOptions {
    /** The exact source text of each inline `<script>` block (hashed with sha256). */
    scripts?: string[];
    /** Extra `connect-src` origins beyond `'self'` (e.g. an absolute `apiBase`). */
    connect?: string[];
}
/** sha256 CSP source expression for one inline script/style block. */
export declare function cspHash(source: string): string;
/**
 * A locked-down, route-scoped CSP for a self-contained HTML page: everything
 * denied by default; inline scripts allowed ONLY by hash; styles inline
 * (`style-src 'unsafe-inline'` — hash sources cannot cover `style=""`
 * attributes); fetch restricted to `'self'` plus the given origins. Set it on
 * the route's response so it overrides the app-wide default from
 * `securityPlugin` for that page only.
 */
export declare function pageCsp(options?: PageCspOptions): string;