/** Shared HTML runs with an opaque origin, without access to console storage. */
export declare const SHARED_HTML_CSP: string;
/**
 * Compute SHA-256 CSP hashes for inline `<script>` blocks in an HTML string.
 * Only scripts without a `src` attribute are considered inline.
 */
export declare function computeInlineScriptHashes(html: string): string[];
/**
 * Build a Content-Security-Policy header string.
 *
 * For the gateway console, we use:
 * - `script-src 'self'` + optional SHA-256 hashes for inline scripts (no unsafe-inline)
 * - `style-src 'self' 'unsafe-inline'` (Tailwind + runtime style injection)
 * - `media-src 'self' blob:` (chat voice previews / recorded clips use blob URLs)
 * - `frame-ancestors 'none'` (prevent clickjacking)
 * - `frame-src 'self'` (sandboxed previews and extension UI)
 * - `form-action 'self'` (prevent form submissions to untrusted origins)
 * - `base-uri 'none'` (prevent base tag hijacking)
 * - `object-src 'none'` (prevent plugin execution)
 */
export declare function buildGatewayConsoleCspHeader(options?: {
    inlineScriptHashes?: string[];
    connectSrc?: string;
}): string;