//#region src/core/uri.d.ts
/**
 * URI safety helpers shared by HTML and React renderers.
 *
 * User-supplied URI values flow into anchor `href` attributes. Without
 * scheme validation a value such as `javascript:alert(1)` becomes a
 * clickable XSS sink — HTML escaping does not help, since the dangerous
 * payload sits inside the scheme rather than the body of the attribute.
 *
 * These helpers exist so the HTML renderer (`html/renderers.ts`) and the
 * React renderer (`react/headlessRenderers.tsx`) apply identical rules
 * when deciding whether a string is safe to render as an `href`.
 */
/**
 * Decide whether `value` is safe to use as an anchor `href`.
 *
 * Returns `true` when the value is either a relative reference (no scheme
 * component) or an absolute URI using `http`/`https`. Returns `false`
 * for any other scheme, including dangerous ones like `javascript:` and
 * `data:`, and for any value that splices ASCII tab/newline/NUL bytes
 * into its scheme — the WHATWG URL parser strips those before scheme
 * detection, so accepting them would let `"java\tscript:alert(1)"`
 * resolve to `javascript:alert(1)` in a browser.
 */
declare function isSafeHyperlink(value: string): boolean;
/**
 * Decide whether `value` is safe to interpolate into a `mailto:` URI.
 *
 * The check rejects values that do not match the standard email format
 * pattern. The format pattern excludes whitespace, but it does permit
 * `%`, and a browser decodes percent-escapes at click time — so a value
 * such as `"foo%0Abcc:victim@bar.com"` would inject a `Bcc:` header into
 * the resulting `mailto:` URI. Refuse any value containing `%` to close
 * that header-injection vector. The plain email-format regex stays a
 * pure email-syntax check; the additional `%` filter lives here so other
 * callers of the format pattern (form validators, JSON Schema
 * `format: email` checks) are not affected.
 */
declare function isSafeMailtoAddress(value: string): boolean;
/**
 * Decide whether `key` is one of the prototype-polluting property names
 * (`__proto__`, `constructor`, `prototype`).
 *
 * Used by JSON Pointer resolvers and by the JSON Schema `properties`
 * walker to refuse traversal into these names.
 */
declare function isPrototypePollutingKey(key: string): boolean;
//#endregion
export { isPrototypePollutingKey, isSafeHyperlink, isSafeMailtoAddress };