/**
 * Derive a project's CSP origins from the source it publishes.
 *
 * The platform floor lists what the *platform* emits. Anything a project loads
 * from elsewhere -- a stock-photo host, its own asset CDN, a video origin --
 * has to be admitted separately, and until now the only way to do that was
 * `security.csp`. That made a working site depend on configuration the project
 * had no reason to know it needed: an audit of the hosted fleet found ~100
 * projects loading blocked assets and two that had declared anything.
 *
 * This module closes that gap by reading the origins out of the project's own
 * released source, so `security.csp` becomes an override for what static
 * analysis cannot see rather than a prerequisite for a site that works.
 *
 * Two properties make that safe rather than merely convenient:
 *
 * 1. **Only passive-content directives are derived.** `img-src`, `media-src`
 *    and `font-src` decide whether a logo renders. `script-src` and
 *    `connect-src` decide whether a third party can execute code in the page
 *    or receive data from it. Deriving those would mean anyone able to
 *    influence source -- a compromised dependency, a merged pull request,
 *    CMS-authored MDX -- could grant themselves execution or an exfiltration
 *    endpoint, collapsing two independent barriers into one. Every project in
 *    the audit was fixed by passive directives alone.
 *
 * 2. **Origins come from an immutable release.** Derivation runs over the
 *    source a release pins, not over live content, so a script injected at
 *    runtime cannot extend the allowlist it is subject to.
 *
 * Derivation is deliberately incomplete. A URL assembled at runtime -- a
 * template literal, a CMS field, an environment variable -- is invisible here,
 * and those projects still declare `security.csp`. Under-deriving costs a
 * broken image; over-deriving costs the policy its meaning.
 *
 * @module security/http/derived-csp-origins
 */
/** Directives this module is permitted to contribute to. */
export declare const DERIVABLE_CSP_DIRECTIVES: readonly ["img-src", "media-src", "font-src"];
export type DerivableCspDirective = (typeof DERIVABLE_CSP_DIRECTIVES)[number];
export type DerivedCspOrigins = Readonly<Partial<Record<DerivableCspDirective, readonly string[]>>>;
/** A source file as the release stores it. */
export interface DerivationSourceFile {
    readonly path: string;
    readonly content?: string;
}
/**
 * Collect the passive-content origins a project's source references.
 *
 * Pure over its input: callers hand it the file set a release pins, and the
 * result is stable for that set, which is what lets it be computed once per
 * release rather than per request.
 */
export declare function deriveCspOriginsFromSource(files: readonly DerivationSourceFile[]): DerivedCspOrigins;
//# sourceMappingURL=derived-csp-origins.d.ts.map