/**
 * What a host's sandbox refuses, found in the built Admin MCP App. The App runs in a host's iframe with no Admin session and no
 * `/admin/api`, and under the CSP the application declared (`defineAdmin({ mcp: { csp } })`), so a build that reaches for any of
 * them fails here instead of in front of a user. `window.open` and `target="_blank"` only warn: the sandbox blocks navigation, so
 * they do nothing, but a component may branch around them.
 *
 * Best effort: it reads the built text for the patterns below, so a URL assembled at run time is not seen. The runtime backstop is
 * the generated compatibility test, which loads the App under the spec's default CSP.
 */
/** `AdminMcpCsp`: the remote origins the App may load from. */
export interface McpCsp {
    readonly connectDomains?: readonly string[];
    readonly resourceDomains?: readonly string[];
    readonly frameDomains?: readonly string[];
    readonly baseUriDomains?: readonly string[];
}
/** Which CSP list a remote use needs: a resource load, a script's request, or a frame. */
export type Kind = "resource" | "connect" | "frame";
export type Hit = {
    readonly rule: "api" | "cookie" | "open" | "blank";
} | {
    readonly rule: "remote";
    readonly url: string;
    readonly kind: Kind;
};
/** Every rule a piece of source or output breaks. */
export declare function hitsOf(code: string): Hit[];
/** Whether the list `kind` needs covers `url`: a scheme and host, `*.` for any subdomain, a port when given. */
export declare function declared(url: string, csp: McpCsp | undefined, kind?: Kind): boolean;
/** What `defineAdmin({ mcp: { csp } })` declares that a CSP cannot use: a list of origins `https://host[:port]` or `https://*.host`. */
export declare function cspProblems(csp: McpCsp | undefined): string[];
/** What was found, and where: modules of the build, and slots of the application's definition when they could be read. */
export interface Source {
    readonly module?: string;
    readonly slot?: string;
    readonly hits: readonly Hit[];
}
export declare const GUIDE = "the \"Customising Admin for MCP hosts\" section of docs/handbook/guides/mcp-apps.md (shipped in @aotter/mantle/docs)";
/**
 * `html` is the whole built file; `sources` say which module or slot each hit came from. Returns the build's errors and warnings,
 * as lines; an error means the App would break in a host. `libraries` are Mantle's own directories: their code is not the
 * application's, so a hit there only counts for what the host would refuse by itself (it writes the sidebar's cookie only when
 * a browser-only component toggles it) and does not warn.
 */
export declare function checkMcpApp(html: string, csp: McpCsp | undefined, sources: readonly Source[], { libraries }?: {
    readonly libraries?: readonly string[];
}): {
    readonly errors: string[];
    readonly warnings: string[];
};