/**
 * The two Content-Security-Policies of the editor plugin contract (DES-artifact-editor-plugins §8.2,
 * EP-C1). Spelled once, pinned by test — a header is only as good as its exact text.
 *
 *  - {@link bundleHeaders}: on the bundle response. `sandbox allow-scripts` sandboxes the bundle even
 *    when opened top-level; `default-src 'none'` + `connect-src 'none'` is the line that protects the
 *    local no-auth daemon (no fetch, XHR, WebSocket, EventSource or beacon); `form-action 'none'`,
 *    `base-uri 'none'`, no workers, no manifest. `script-src 'unsafe-inline'` is acceptable only
 *    because the bundle is ONE hashed file and nothing else can load. An editor holding
 *    `network.media` (first-party `wicked-page`: agent-authored pages use web images) gets
 *    `img-src … https:` and `font-src … https:` — a GET-only channel, never `connect-src`.
 *    `navigate-to` / `prefetch-src` are deliberately absent: no browser enforces them (review B1).
 *  - {@link shellCsp}: on studio's own shell document. A sandboxed frame may navigate ITSELF, and
 *    once it does the bundle's policy is gone — so the shell limits what any frame may point at:
 *    crew's own editors route, crew's interactive proxy (today's Document mode), `blob:` and
 *    `data:`. The origin is written per response because a path cannot follow `'self'`.
 */
import type { EditorRecord } from './registry.js';
export declare const BUNDLE_CSP_BASE: string;
/** Exactly the §8.2 header set for one editor's bundle. */
export declare function bundleHeaders(record: Pick<EditorRecord, 'manifest' | 'firstParty'>): Record<string, string>;
/** The shell's `frame-src` policy for the request's own origin (`scheme://host[:port]`). */
export declare function shellCsp(origin: string): string;
/** `scheme://host` of a request, from what the client sent (a hosted skin may sit behind a proxy). */
export declare function requestOrigin(req: {
    protocol?: string | undefined;
    headers: {
        host?: string | undefined;
    };
}): string;
//# sourceMappingURL=csp.d.ts.map