/**
 * Collect the `'sha256-...'` sources for every inline script in the exported
 * dashboard's HTML files. Reads `*.html` at the export root (the SPA entry plus
 * Next's `404.html` / `_not-found.html`), so any page the host might serve is
 * covered. Best-effort: unreadable files are skipped.
 */
export declare function dashboardScriptHashes(dashboardDir: string): string[];
/**
 * Build the helmet `contentSecurityPolicy` directives for the bundled dashboard.
 * `connectOrigins` (the configured CORS origins) are added to `connect-src` so a
 * dashboard served from a different origin than the collector can still reach the
 * query + live-SSE API.
 */
export declare function buildDashboardCsp(dashboardDir: string, connectOrigins: readonly string[]): {
    useDefaults: false;
    directives: Record<string, string[]>;
};
//# sourceMappingURL=csp.d.ts.map