/**
 * URL hygiene for values that cross the wire into a customer's page.
 *
 * Both helpers exist because the SDK runs INSIDE the customer's origin:
 * anything the server sends is rendered with the customer's privileges, so a
 * value we would never type ourselves must be refused here rather than
 * escaped downstream. Refusal is silent — never a throw, never a console
 * line — because the failure mode this package optimises for is "the
 * creative quietly stops adapting", not "the customer's console fills up".
 */
/**
 * Vet a server-supplied action URL before it reaches an `<a href>`.
 *
 * Allowed through unchanged:
 *   - absolute `https:`, `http:`, `mailto:`, `tel:` URLs;
 *   - relative references — `/…`, `./…`, `#…`, `?…` — which resolve against
 *     the customer's own origin; plus protocol-relative `//…`, which keeps
 *     the page's scheme and is no worse than the absolute `https:` URLs we
 *     already allow (both can point at any host).
 *
 * Anything else returns `undefined`: `javascript:`/`data:`/`vbscript:`
 * outright, but also bare strings with no scheme and no relative prefix —
 * we cannot prove where they point, and a CTA with no destination degrades
 * to a plain button, which is the honest outcome.
 *
 * The input is trimmed first because browsers strip leading ASCII whitespace
 * from `href` before parsing — without that, `" javascript:…"` would sneak a
 * scheme past a prefix check that the browser would then honour.
 */
export declare function safeActionUrl(url: string | null | undefined): string | undefined;
/**
 * Is this apiBase allowed to carry SDK traffic?
 *
 * Production traffic is `https:` only — an `http:` apiBase sends campaign
 * configuration and context over a channel any middlebox can rewrite, which
 * is S-4 with extra steps. The one exception is loopback
 * (`http://localhost`, `http://127.0.0.1`, any port), because local
 * development against a dev edge is a real and legitimate setup.
 */
export declare function isSecureApiBase(apiBase: string): boolean;
/**
 * Is this apiBase first-party — the hosted SparkleTree edge, or loopback?
 *
 * "First-party" is the fixed set of hosts SparkleTree itself operates:
 * sparkletree.io (the platform and the campaigns edge alias) and qrtree.ai
 * (the public edge origin the dashboard writes into every publishable key,
 * `p.qrtree.ai`). A key minted by the dashboard therefore mints as-is; a
 * hand-encoded key pointing anywhere else still gets content and no token.
 *
 * The publishable key is an unsigned address ANYONE can hand-encode (see
 * publishableKey.ts), so an apiBase that arrived via a key proves nothing
 * about who chose it. The one value that must never follow an unproven
 * address is the signed mint token: it is a real spend credential, and a
 * doctored key pointing at an attacker host would receive it on the mint
 * POST and replay it against the real API for its TTL (security review
 * S-2). The mint therefore fires only when the apiBase is explicit (the
 * developer's own prop — their choice to make), first-party, or loopback.
 * Self-hosted bases are exactly what the explicit `apiBase` escape hatch is
 * for; a self-made key carrying a third-party host gets content but no mint.
 */
export declare function isFirstPartyApiBase(apiBase: string): boolean;
//# sourceMappingURL=safeUrl.d.ts.map