/**
 * String Security Validator
 *
 * Detects embedded HTML tags in non-narrative string fields. FHIR requires
 * that plain string / text / markdown values remain free of HTML / script
 * content for security reasons; only `Narrative.div` (which is typed as
 * `xhtml`) is allowed to carry HTML content, and that is handled by the
 * dedicated narrative-validator.
 *
 * The Java reference validator emits this as:
 *   severity: error
 *   code: invalid
 *   text: "The string value contains text that looks like embedded HTML
 *          tags, which are not allowed for security reasons in this context"
 *
 * See `pat-security-bad-string` baseline in fhir-test-cases.
 */
import type { ValidationIssue } from '../types';
export declare class StringSecurityValidator {
    /**
     * Walk a resource and flag any non-narrative string field that
     * contains HTML-tag-like content.
     */
    validate(resource: any): ValidationIssue[];
    private walk;
    private isRenderingXhtmlExtensionValue;
    /**
     * Check if a given path points inside a narrative payload where
     * XHTML is the expected content type. Narrative shows up as
     * `<Resource>.text.div` (R4) and within `contained[n].text.div`,
     * `Composition.section.text.div`, etc. We treat any `.text.div`
     * suffix as a narrative slot and skip the HTML check there.
     */
    private isInsideNarrative;
    /**
     * StructureDefinitions often carry formal prose, XPath/FHIRPath, and mapping
     * expressions that mention XHTML/XML tokens like `<a>` as literal grammar.
     * Those are not patient-facing narrative strings and should not be treated
     * as embedded HTML content.
     */
    private isConformanceDefinitionDocumentation;
}
export declare const stringSecurityValidator: StringSecurityValidator;
//# sourceMappingURL=string-security-validator.d.ts.map