/**
 * The two JSX attribute rules that are about the origin rather than the type:
 * `srcdoc`, which builds a whole document inside this page's origin (WEB-S3),
 * and the URL attributes whose written value can name a script scheme (WEB-S2).
 *
 * D115 P4 R3b. Both are asked of a written value only; a value that arrives at
 * run time is the runtime attribute check's question, so nothing here reads an
 * inferred type.
 */
import { type WebJsxAttribute as JSXAttribute, type WebJsxElementExpression as JSXElementExpression } from "../../ast.ts";
import { type JsxAnalysisHost } from "./host.ts";
/**
 * WEB-S3: `srcdoc` builds a whole document out of a string, and that document
 * inherits this page's origin — so it is a second raw-HTML boundary next to
 * the one the charter names (`unsafe:html`), reachable with no marker at all.
 * The marker this one gets is `sandbox`, because sandbox is what actually
 * takes the origin away; requiring it makes the boundary visible where it is
 * crossed. `allow-scripts allow-same-origin` together hands the origin back,
 * so the pair is refused by name rather than accepted as a sandbox.
 */
export declare function reportIframeSrcdocSandbox(host: JsxAnalysisHost, expression: JSXElementExpression, attributes: ReadonlyMap<string, JSXAttribute>): void;
/**
 * WEB-S2: the analyzer already refuses an anchor that opens a window without
 * 'noopener', so a URL attribute whose value is a script scheme cannot be the
 * one URL question it declines to ask. A written-down URL is answered here; a
 * value that arrives at run time is answered by the runtime attribute check.
 */
export declare function reportUrlAttributeScheme(host: JsxAnalysisHost, attribute: JSXAttribute): void;
//# sourceMappingURL=security.d.ts.map