/** * The player's single audited raw-`innerHTML` sink for compile-time-constant * markup: control icons from `controls/icons.ts` and fixed scaffolding like * the loading spinner. Callers MUST pass only module-level string constants — * never user input, server responses, media metadata, or anything derived * from them. Dynamic content goes through `sanitize.ts` (DOMPurify) instead. * * Centralizing the sink lets the semgrep `no-raw-innerhtml` rule run at ERROR * with exactly one suppression in shipped player code. */ export declare function setStaticHtml(el: Element, constantHtml: string): void; //# sourceMappingURL=static-html.d.ts.map