/**
 * Making README text safe and readable before it is rendered.
 *
 * Two jobs: deciding which URLs may reach the DOM, and reducing the HTML that
 * READMEs are full of down to Markdown the renderer understands.
 *
 * This lives outside `src/client` on purpose. It is compiled into both tsc
 * programs — the browser half imports it, and the host build emits it to
 * `lib/` — which is what lets the offline smoke checks exercise it directly.
 * A security boundary that cannot be tested is a security boundary nobody
 * knows the state of.
 *
 * Like `types.ts`, it must stay import-free so neither program drags the
 * other's `Context` declaration merge in behind it.
 */
/**
 * Inline Markdown constructs, matched in priority order within one pass.
 *
 * Order is load-bearing. The linked-image alternative must come before the
 * plain link: nearly every README opens with a row of badges written as
 * `[![alt](image)](target)`, and the plain-link pattern matches a prefix of
 * that — taking `![alt` as the label and the image URL as the destination —
 * which leaves `](target)` stranded as literal text in the output.
 *
 * Lives here rather than beside the renderer so the ordering can be asserted
 * without standing up React.
 */
export declare const INLINE: RegExp;
/**
 * Resolve a possibly-relative URL, refusing anything that is not http(s).
 *
 * React escapes text content but does not vet URL attributes: it will pass
 * `javascript:alert(1)` to an `href` unchanged. README text comes from
 * strangers' repositories, so every URL is filtered here before it reaches
 * the DOM. Schemes are checked after resolution as well as before, because a
 * relative-looking string can still resolve somewhere unexpected.
 * @param raw - the URL as written in the document.
 * @param baseUrl - the document's own location, when known.
 * @returns an absolute http(s) URL, or undefined when unusable.
 */
export declare function safeUrl(raw: string, baseUrl?: string): string | undefined;
/**
 * Reduce the HTML in a README to Markdown.
 *
 * READMEs routinely open with a centred `<p><img></p>` banner and an `<h1>`,
 * because GitHub renders HTML and Markdown together. This renderer never emits
 * HTML — that is what makes it injection-proof — so without this pass those
 * tags would be displayed as literal text, which is safe but unreadable.
 *
 * Only tags with a Markdown equivalent are converted; every other tag is
 * dropped and its text content kept. Nothing here produces markup: the output
 * is Markdown source that still goes through the normal renderer, so no
 * attribute an author writes can reach the DOM by this route.
 * @param source - the raw README.
 * @returns Markdown with the HTML folded in.
 */
export declare function htmlToMarkdown(source: string): string;