/**
 * Attribute-binding guards shared by the client `bq-bind` directive and the
 * SSR renderers.
 *
 * The attribute *name* comes from the template (author-trusted), but the
 * *value* is runtime data — exactly the class of input the framework tells
 * authors is safe to bind. URL-bearing attributes must therefore reject
 * dangerous protocols, inline event handlers must never be bindable, and
 * `srcdoc` must be treated as an HTML sink (the browser entity-decodes the
 * attribute and parses it as a full document, so attribute-escaping alone is
 * insufficient).
 *
 * @module bquery/security
 * @internal
 */
/**
 * Attributes whose values the browser resolves as URLs.
 * @internal
 */
export declare const URL_BIND_ATTRIBUTES: Set<string>;
/**
 * Check whether a URL value bound to an attribute uses a safe protocol.
 * @internal
 */
export declare const isSafeBindUrl: (value: string) => boolean;
/**
 * Check every URL in a srcset value (comma-separated "url [descriptor]").
 * @internal
 */
export declare const isSafeBindSrcset: (value: string) => boolean;
/**
 * How a runtime-bound attribute value may be applied:
 * - `'set'` — safe to write as-is
 * - `'drop'` — must not be written (inline handler or unsafe URL)
 * - `'sanitize-html'` — value is an HTML sink and must be sanitized first
 * @internal
 */
export type BindAttributeVerdict = 'set' | 'drop' | 'sanitize-html';
/**
 * Decide how a runtime-bound attribute value may be applied to an element.
 * @internal
 */
export declare const checkBoundAttribute: (name: string, value: string) => BindAttributeVerdict;
//# sourceMappingURL=bind-guard.d.ts.map