/**
 * @file secure_csp_generator.ts
 * @description
 *   SecureCSPGenerator: A hardened Content-Security-Policy (CSP) generator
 *   that fetches HTML content, parses resource references, and builds a
 *   strict CSP header. Core features include:
 *     - HTTPS-only scheme enforcement (configurable)
 *     - SSRF protection (rejects private IPv4/IPv6 by default)
 *     - Streamed HTML download with timeout and max-body-size limits
 *     - Inline <script> hashing (SHA-256) and optional nonce/unsafe-inline
 *     - Inline <style> URL extraction and optional unsafe-inline
 *     - Auto-adding of upgrade-insecure-requests & block-all-mixed-content
 *     - Pluggable logging via Console-like interface
 *     - Extensible directive presets and testable, modular helpers
 *
 * @example
 * import { SecureCSPGenerator } from './secure_csp_generator';
 *
 * (async () => {
 *   const generator = new SecureCSPGenerator('https://example.com', {
 *     presets: { 'connect-src': ['https://api.example.com'] },
 *     allowUnsafeInlineStyle: false,
 *     maxBodySize: 1_000_000,     // 1 MB
 *     timeoutMs: 10_000,          // 10 seconds
 *     allowPrivateOrigins: false,
 *   });
 *   const cspHeader = await generator.generate();
 *   console.log('Content-Security-Policy:', cspHeader);
 * })();
 */
import type { SecureCSPGeneratorOptions } from './types.ts';
export type { SecureCSPGeneratorOptions };
/**
 * SecureCSPGenerator:
 * Fetches an HTML page, extracts resource origins,
 * and constructs a robust CSP header string.
 */
export declare class SecureCSPGenerator {
    /** The target URL to analyze. */
    readonly url: URL;
    private readonly opts;
    private readonly logger;
    private html;
    private readonly sources;
    private detectedInlineScript;
    private detectedInlineStyle;
    private detectedEval;
    private nonce;
    /**
     * @param inputUrl - URL of the page to analyze (must be non-empty)
     * @param opts - Configuration options to control fetching and policy
     * @throws Error on invalid URL or insecure scheme when allowHttp=false
     */
    constructor(inputUrl: string, opts?: SecureCSPGeneratorOptions);
    /**
     * Generates a cryptographically secure random nonce.
     * @returns A base64-encoded random string suitable for CSP nonces
     */
    private generateNonce;
    /**
     * Downloads HTML via fetch, respecting timeouts and size limits.
     * @throws Error if HTTP status not OK, type mismatch, or size exceeded
     */
    private fetchHtml;
    /**
     * Resolves a raw URL or token into an origin/token and adds it to the CSP set.
     * @param directive - CSP directive to update (e.g., 'script-src')
     * @param rawSrc - URL, nonce/hash token, or relative path
     */
    private resolveAndAdd;
    /**
     * Tests if an IPv4/v6 address is private or loopback.
     */
    private isPrivateIp;
    /**
     * Ensures the directive has an initialized Set, then returns it.
     */
    private ensureSet;
    /**
     * Parses the downloaded HTML, extracts external resources,
     * inline scripts/styles, and computes hashes or origins.
     */
    private parse;
    private cssUrlRe;
    private cssImportRe;
    /**
     * Extracts CSS resource URLs from inline CSS text and adds them.
     */
    private extractCssUrls;
    /**
     * Public entry point: fetches, parses, and constructs the final CSP header.
     * @returns A fully-formed CSP header string.
     */
    generate(): Promise<string>;
}