//#region src/constants.d.ts
declare const CSP_HEADER_NAME = "Content-Security-Policy";
/**
 * Full list of google supported domains.
 *
 * To be used in place of `https://*.google.<TLD>` in CSP directives
 *
 * @see https://www.google.com/supported_domains
 */
declare const GOOGLE_SUPPORTED_DOMAINS = ".google.com .google.ad .google.ae .google.com.af .google.com.ag .google.al .google.am .google.co.ao .google.com.ar .google.as .google.at .google.com.au .google.az .google.ba .google.com.bd .google.be .google.bf .google.bg .google.com.bh .google.bi .google.bj .google.com.bn .google.com.bo .google.com.br .google.bs .google.bt .google.co.bw .google.by .google.com.bz .google.ca .google.cd .google.cf .google.cg .google.ch .google.ci .google.co.ck .google.cl .google.cm .google.cn .google.com.co .google.co.cr .google.com.cu .google.cv .google.com.cy .google.cz .google.de .google.dj .google.dk .google.dm .google.com.do .google.dz .google.com.ec .google.ee .google.com.eg .google.es .google.com.et .google.fi .google.com.fj .google.fm .google.fr .google.ga .google.ge .google.gg .google.com.gh .google.com.gi .google.gl .google.gm .google.gr .google.com.gt .google.gy .google.com.hk .google.hn .google.hr .google.ht .google.hu .google.co.id .google.ie .google.co.il .google.im .google.co.in .google.iq .google.is .google.it .google.je .google.com.jm .google.jo .google.co.jp .google.co.ke .google.com.kh .google.ki .google.kg .google.co.kr .google.com.kw .google.kz .google.la .google.com.lb .google.li .google.lk .google.co.ls .google.lt .google.lu .google.lv .google.com.ly .google.co.ma .google.md .google.me .google.mg .google.mk .google.ml .google.com.mm .google.mn .google.com.mt .google.mu .google.mv .google.mw .google.com.mx .google.com.my .google.co.mz .google.com.na .google.com.ng .google.com.ni .google.ne .google.nl .google.no .google.com.np .google.nr .google.nu .google.co.nz .google.com.om .google.com.pa .google.com.pe .google.com.pg .google.com.ph .google.com.pk .google.pl .google.pn .google.com.pr .google.ps .google.pt .google.com.py .google.com.qa .google.ro .google.ru .google.rw .google.com.sa .google.com.sb .google.sc .google.se .google.com.sg .google.sh .google.si .google.sk .google.com.sl .google.sn .google.so .google.sm .google.sr .google.st .google.com.sv .google.td .google.tg .google.co.th .google.com.tj .google.tl .google.tm .google.tn .google.to .google.com.tr .google.tt .google.com.tw .google.co.tz .google.com.ua .google.co.ug .google.co.uk .google.com.uy .google.co.uz .google.com.vc .google.co.ve .google.co.vi .google.com.vn .google.vu .google.ws .google.rs .google.co.za .google.co.zm .google.co.zw .google.cat";
//#endregion
//#region src/types.d.ts
/**
 * Content Security Policy record type.
 *
 * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
 */
interface ContentSecurityPolicyRecord {
  'child-src': string;
  'connect-src': string;
  'default-src': string;
  'fenced-frame-src': string;
  'font-src': string;
  'frame-src': string;
  'img-src': string;
  'manifest-src': string;
  'media-src': string;
  'object-src': string;
  'script-src': string;
  'script-src-elem': string;
  'script-src-attr': string;
  'style-src': string;
  'style-src-elem': string;
  'style-src-attr': string;
  'worker-src': string;
  'base-uri': string;
  'sandbox': string;
  'form-action': string;
  'frame-ancestors': string;
  'report-to': string;
  'require-trusted-types-for ': string;
  'trusted-types': string;
  'upgrade-insecure-requests': '';
  /** @deprecated */
  'block-all-mixed-content': '';
  /** @deprecated */
  'prefetch-src': string;
  /** @deprecated */
  'report-uri': string;
}
/**
 * Content Security Policy directive type.
 *
 * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
 */
type ContentSecurityPolicyDirective = keyof ContentSecurityPolicyRecord;
/**
 * Content Security Policy config type.
 */
type ContentSecurityPolicyConfig = Partial<ContentSecurityPolicyRecord>;
//#endregion
//#region src/create-csp-header.d.ts
interface CreateCspHeaderOptions {
  /**
   * Include header name in the output or not.
   *
   * @default false
   */
  includeHeaderName?: boolean;
  /**
   * Presets to include in the CSP header.
   *
   * @default []
   */
  presets?: ContentSecurityPolicyConfig[];
}
/**
 * Helper to create a Content-Security-Policy header.
 */
declare const createCspHeader: (config: ContentSecurityPolicyConfig, {
  includeHeaderName,
  presets
}?: CreateCspHeaderOptions) => string;
//#endregion
//#region src/merge-csp-configs.d.ts
/**
 * Helper to merge multiple CSP configs.
 */
declare const mergeCspConfigs: (configs: ContentSecurityPolicyConfig[]) => ContentSecurityPolicyConfig;
//#endregion
//#region src/merge-csp-configs-to-set.d.ts
type ContentSecurityPolicyConfigSet = Partial<Record<ContentSecurityPolicyDirective, Set<string>>>;
/**
 * Helper to merge multiple CSP configs to configs set.
 */
declare const mergeCspConfigsToSet: (configs: ContentSecurityPolicyConfig[]) => ContentSecurityPolicyConfigSet;
//#endregion
//#region src/presets/datadog.d.ts
/**
 * CSP preset for datadog intake URLs
 *
 * @see https://docs.datadoghq.com/integrations/content_security_policy_logs/?tab=firefox#intake-urls
 */
declare const CSP_PRESET_DATADOG_INTAKE_URLS: {
  'connect-src': string;
};
/**
 * CSP preset for datadog web worker
 *
 * @see https://docs.datadoghq.com/integrations/content_security_policy_logs/?tab=firefox#web-worker
 */
declare const CSP_PRESET_DATADOG_WEB_WORKER: {
  'worker-src': string;
};
/**
 * CSP preset for datadog CDN bundle URL
 *
 * @see https://docs.datadoghq.com/integrations/content_security_policy_logs/?tab=firefox#cdn-bundle-url
 */
declare const CSP_PRESET_DATADOG_CDN_BUNDLE_URL: {
  'script-src': string;
};
//#endregion
//#region src/presets/google-ads.d.ts
/**
 * CSP directives for Google Ads Conversion, Remarketing, or Conversion Linker tag
 *
 * This preset only includes the basic directives.
 *
 * You could add Google top-level domains (TLDs) to `img-src` as needed.
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#google_ads
 */
declare const CSP_PRESET_GOOGLE_ADS: {
  'connect-src': string;
  'frame-src': string;
  'img-src': string;
  'script-src': string;
};
/**
 * CSP directives for Google Ads Conversion, Remarketing, or Conversion Linker tag
 *
 * This preset includes the full list of Google top-level domains (TLDs) in `img-src`.
 *
 * You may not need all of them if your site is not targeting all countries.
 *
 * The full list will make the CSP header too large, and you may need to update your server configs to allow large headers.
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#google_ads
 */
declare const CSP_PRESET_GOOGLE_ADS_FULL_TLD: {
  'connect-src': string;
  'img-src': string;
};
/**
 * CSP directives for google ads user data beacon
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#google_ads_user_data_beacon
 */
declare const CSP_PRESET_GOOGLE_ADS_USER_DATA_BEACON: {
  'connect-src': string;
  'frame-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/google-analytics-4.d.ts
/**
 * CSP directives for Google Analytics 4 (Google Analytics)
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#google_analytics_4_google_analytics
 */
declare const CSP_PRESET_GOOGLE_ANALYTICS_4: {
  'connect-src': string;
  'img-src': string;
  'script-src': string;
};
/**
 * CSP directives for Google Analytics 4 (Google Analytics) deployments using Google Signals
 *
 * This preset only includes the basic directives.
 *
 * You could add Google top-level domains (TLDs) to `connect-src` and `img-src` as needed.
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#google_analytics_4_google_analytics
 */
declare const CSP_PRESET_GOOGLE_ANALYTICS_4_GOOGLE_SIGNALS: {
  'connect-src': string;
  'frame-src': string;
  'img-src': string;
  'script-src': string;
};
/**
 * CSP directives for Google Analytics 4 (Google Analytics) deployments using Google Signals
 *
 * This preset includes the full list of Google top-level domains (TLDs) in `connect-src` and `img-src`.
 *
 * You may not need all of them if your site is not targeting all countries.
 *
 * The full list will make the CSP header too large, and you may need to update your server configs to allow large headers.
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#google_analytics_4_google_analytics
 */
declare const CSP_PRESET_GOOGLE_ANALYTICS_4_GOOGLE_SIGNALS_FULL_TLD: {
  'connect-src': string;
  'img-src': string;
};
//#endregion
//#region src/presets/google-fonts.d.ts
/**
 * CSP directives for google fonts
 *
 * @see https://content-security-policy.com/examples/google-fonts/
 */
declare const CSP_PRESET_GOOGLE_FONTS: {
  'font-src': string;
  'style-src': string;
};
//#endregion
//#region src/presets/google-identity.d.ts
/**
 * CSP directives for google identity
 *
 * @see https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid#content_security_policy
 */
declare const CSP_PRESET_GOOGLE_IDENTITY: {
  'connect-src': string;
  'frame-src': string;
  'script-src': string;
  'style-src': string;
};
//#endregion
//#region src/presets/google-tag-manager.d.ts
/**
 * CSP directives for google tag manager with nonce.
 *
 * Notice that `script-src 'nonce-<value>'` is not included, which should be added yourself.
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#enable_the_container_tag_to_use_csp
 */
declare const CSP_PRESET_GOOGLE_TAG_MANAGER_NONCE: {
  'connect-src': string;
  'img-src': string;
};
/**
 * CSP directives for google tag manager with 'unsafe-inline'
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#enable_the_container_tag_to_use_csp
 */
declare const CSP_PRESET_GOOGLE_TAG_MANAGER_UNSAFE_INLINE: {
  'connect-src': string;
  'img-src': string;
  'script-src': string;
};
/**
 * CSP directives for google tag manager with custom javascript variables
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#custom_javascript_variables
 */
declare const CSP_PRESET_GOOGLE_TAG_MANAGER_CUSTOM_JAVASCRIPT_VARIABLES: {
  'script-src': string;
};
/**
 * CSP directives for google tag manager preview mode
 *
 * Notice that the GTM preview mode is not properly maintained by Google:
 * - The docs and the actual requests are inconsistent. You may need to manually update the `img-src` and `style-src` directives.
 * - The css file and some requests of preview mode would be blocked by COEP due to lack of CORP header. You may need to disable COEP for preview mode.
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#preview_mode
 */
declare const CSP_PRESET_GOOGLE_TAG_MANAGER_PREVIEW_MODE: {
  'font-src': string;
  'img-src': string;
  'script-src': string;
  'style-src': string;
};
//#endregion
//#region src/presets/google-universal-analytics.d.ts
/**
 * CSP directives for google universal analytics
 *
 * @see https://developers.google.com/tag-platform/security/guides/csp#universal_analytics_google_analytics
 */
declare const CSP_PRESET_GOOGLE_UNIVERSAL_ANALYTICS: {
  'connect-src': string;
  'img-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/hotjar.d.ts
/**
 * CSP directives for hotjar
 *
 * @see https://help.hotjar.com/hc/en-us/articles/115011640307-Content-Security-Policies
 */
declare const CSP_PRESET_HOTJAR: {
  'connect-src': string;
  'font-src': string;
  'img-src': string;
  'script-src': string;
  'style-src': string;
};
//#endregion
//#region src/presets/infogram.d.ts
/**
 * CSP directives for infogram embed
 *
 * @see https://support.infogram.com/hc/en-us/sections/360000124013-Embed
 */
declare const CSP_PRESET_INFOGRAM_EMBED: {
  'frame-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/livechat.d.ts
/**
 * CSP directives for LiveChat
 *
 * @see https://www.livechat.com/help/use-livechat-with-content-security-policy/
 */
declare const CSP_PRESET_LIVECHAT: {
  'child-src': string;
  'connect-src': string;
  'frame-src': string;
  'img-src': string;
  'media-src': string;
  'object-src': string;
  'script-src': string;
  'style-src': string;
};
//#endregion
//#region src/presets/podscribe.d.ts
/**
 * CSP directives for podscribe
 *
 * Notice that the official documentation is incorrect:
 *
 * - `img-src` should include `https://verifi.podscribe.com`
 * - `connect-src` should not include `https://pixel.tapad.com`, as it is not seen in their source code nor in the network requests.
 * - `connect-src` might include `https://const.uno` because it is used in the source code and will be request with `with_stid` parameter enabled.
 *   However, it is not necessary and always returns an empty result for now.
 *
 * @see https://podscribe.helpkit.so/attribution-and-incrementality/g4g8w3hppouCfkXZdcx6FV/advertiser-tracking-via-javascript-pixel/dpbUfAVkZgu9ehyP1uztZv
 */
declare const CSP_PRESET_PODSCRIBE: {
  'connect-src': string;
  'img-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/reddit.d.ts
/**
 * CSP directives for reddit embed
 */
declare const CSP_PRESET_REDDIT_EMBED: {
  'frame-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/sentry.d.ts
/**
 * CSP preset for sentry session replay
 *
 * @see https://docs.sentry.io/platforms/javascript/session-replay/#content-security-policy-csp
 */
declare const CSP_PRESET_SENTRY_SESSION_REPLAY: {
  'worker-src': string;
};
//#endregion
//#region src/presets/tiktok.d.ts
/**
 * CSP directives for tiktok embed
 */
declare const CSP_PRESET_TIKTOK_EMBED: {
  'frame-src': string;
  'script-src': string;
};
/**
 * CSP directives for tiktok pixel
 *
 * @see https://business-api.tiktok.com/portal/docs?id=1739585704427522
 */
declare const CSP_PRESET_TIKTOK_PIXEL: {
  'connect-src': string;
  'frame-src': string;
  'img-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/vimeo.d.ts
/**
 * CSP directives for vimeo embed
 *
 * @see https://github.com/vimeo/player.js?tab=readme-ov-file#readme
 */
declare const CSP_PRESET_VIMEO_EMBED: {
  'connect-src': string;
  'frame-src': string;
  'img-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/x.d.ts
/**
 * CSP directives for x embed
 */
declare const CSP_PRESET_X_EMBED: {
  'frame-src': string;
  'script-src': string;
};
//#endregion
//#region src/presets/youtube.d.ts
/**
 * CSP directives for youtube embed
 */
declare const CSP_PRESET_YOUTUBE_EMBED: {
  'frame-src': string;
  'img-src': string;
};
//#endregion
export { CSP_HEADER_NAME, CSP_PRESET_DATADOG_CDN_BUNDLE_URL, CSP_PRESET_DATADOG_INTAKE_URLS, CSP_PRESET_DATADOG_WEB_WORKER, CSP_PRESET_GOOGLE_ADS, CSP_PRESET_GOOGLE_ADS_FULL_TLD, CSP_PRESET_GOOGLE_ADS_USER_DATA_BEACON, CSP_PRESET_GOOGLE_ANALYTICS_4, CSP_PRESET_GOOGLE_ANALYTICS_4_GOOGLE_SIGNALS, CSP_PRESET_GOOGLE_ANALYTICS_4_GOOGLE_SIGNALS_FULL_TLD, CSP_PRESET_GOOGLE_FONTS, CSP_PRESET_GOOGLE_IDENTITY, CSP_PRESET_GOOGLE_TAG_MANAGER_CUSTOM_JAVASCRIPT_VARIABLES, CSP_PRESET_GOOGLE_TAG_MANAGER_NONCE, CSP_PRESET_GOOGLE_TAG_MANAGER_PREVIEW_MODE, CSP_PRESET_GOOGLE_TAG_MANAGER_UNSAFE_INLINE, CSP_PRESET_GOOGLE_UNIVERSAL_ANALYTICS, CSP_PRESET_HOTJAR, CSP_PRESET_INFOGRAM_EMBED, CSP_PRESET_LIVECHAT, CSP_PRESET_PODSCRIBE, CSP_PRESET_REDDIT_EMBED, CSP_PRESET_SENTRY_SESSION_REPLAY, CSP_PRESET_TIKTOK_EMBED, CSP_PRESET_TIKTOK_PIXEL, CSP_PRESET_VIMEO_EMBED, CSP_PRESET_X_EMBED, CSP_PRESET_YOUTUBE_EMBED, type ContentSecurityPolicyConfig, type ContentSecurityPolicyDirective, type ContentSecurityPolicyRecord, CreateCspHeaderOptions, GOOGLE_SUPPORTED_DOMAINS, createCspHeader, mergeCspConfigs, mergeCspConfigsToSet };