import { Plugin } from 'prosemirror-state';
export interface EmbedTarget {
    src: string;
    provider: 'youtube' | 'vimeo' | 'loom' | 'generic';
}
/**
 * Sandbox tokens applied to every embed iframe. Notably this OMITS
 * `allow-top-navigation`, so a framed page cannot redirect the whole tab
 * (the main clickjacking/phishing vector); scripts and same-origin are
 * allowed so third-party players still run. Kept in sync with the sanitizer.
 */
export declare const EMBED_SANDBOX = "allow-scripts allow-same-origin allow-presentation allow-popups";
/** Limits the referrer leaked to the embedded third-party host. */
export declare const EMBED_REFERRER_POLICY = "strict-origin-when-cross-origin";
/**
 * Converts a URL into an embed target. Known providers (YouTube/Vimeo/Loom)
 * are canonicalized to their dedicated embed URLs; any other `https://` URL
 * is accepted as a `generic` embed. The iframe is always sandboxed on render
 * (see EMBED_SANDBOX), so untrusted hosts cannot navigate the top window.
 * Returns null only for non-https or unparseable URLs.
 */
export declare function toEmbedUrl(url: string): EmbedTarget | null;
/**
 * True when a URL is permitted as an embed src (sanitizer check). Any
 * `https://` URL is allowed; the iframe is sandboxed at render time.
 */
export declare function isAllowedEmbedSrc(src: string): boolean;
/**
 * Pasting a bare provider URL onto an empty selection inserts an embed
 * instead of plain text. (Pasting over selected text still creates a link.)
 */
export declare function embedPastePlugin(): Plugin;