/**
 * Per-release cache for {@link deriveCspOriginsFromSource}.
 *
 * Derivation reads every source file a release pins, which is far too much work
 * to repeat per response but exactly the right amount to do once per release:
 * the input is immutable for a given content version, so the result is too.
 *
 * @module security/http/derived-csp-cache
 */
import { type DerivationSourceFile, type DerivedCspOrigins } from "./derived-csp-origins.js";
/** @returns whether this key's diagnostic has not been emitted yet */
export declare function shouldWarnOnceForKey(key: string): boolean;
export interface DerivedCspLookup {
    /** Project scope, so two projects on one pod cannot share an entry. */
    readonly projectScope: string;
    /**
     * Content version, as `resolveStyleContentVersion` spells it. A branch
     * version is stable while its content changes, which is why the caller passes
     * a snapshot identity rather than a branch name where one is available.
     */
    readonly contentVersion: string;
    /** Reads the release's source files. Called only on a miss. */
    readonly loadSourceFiles: () => Promise<readonly DerivationSourceFile[] | null>;
}
/**
 * Derived origins for a content version, computing them at most once.
 *
 * Failure is not fatal: a project whose sources cannot be read gets an empty
 * derivation, which leaves it exactly where it was before this existed -- the
 * platform floor plus whatever `security.csp` declares.
 */
export declare function getDerivedCspOrigins(lookup: DerivedCspLookup): Promise<DerivedCspOrigins>;
/** @internal Test seam. */
export declare function __clearDerivedCspCacheForTests(): void;
//# sourceMappingURL=derived-csp-cache.d.ts.map