/**
 * CSP generation for Dune-hosted apps.
 *
 * `manifest.json` uses `permissions.network` as the app's allowed-origin
 * contract. These rules extend fetch directives only; framing remains owned
 * by Fusion/App Hosting via `frame-ancestors`.
 */
export type { CspFetchDirective, NetworkAllowlistRule, } from './manifest-config-schema';
/**
 * Runtime-shape variant accepted by the CSP builder. The public manifest
 * schema only accepts `CspFetchDirective` values, but the builder runs
 * a defensive lowercase/allowlist filter so JS callers (and any future
 * untrusted input) can't widen the policy with arbitrary directives.
 */
type RuntimeNetworkAllowlistRule = {
    sources: string[];
    directives?: readonly string[];
};
export declare function sanitizeCspSource(raw: string, isDevelopment: boolean): string | null;
/**
 * Like `sanitizeCspSource` but also accepts the keywords and hash sources
 * that are meaningful for `script-src`. Apps with intentionally inline
 * scripts can declare these via a `directives: ['script-src']` rule.
 */
export declare function sanitizeScriptSource(raw: string, isDevelopment: boolean): string | null;
export declare function buildFrameAncestors(isDevelopment: boolean): string;
export declare function buildHostedAppContentSecurityPolicy(isDevelopment: boolean, networkRules: readonly RuntimeNetworkAllowlistRule[] | undefined): string;