/** Matches a real `<script…>…</script>` element (through the first `</script>`). */
export declare function matchScriptElement(html: string, i: number): number;
/** Matches a real `<style…>…</style>` element (through the first `</style>`). */
export declare function matchStyleElement(html: string, i: number): number;
/** Matches an HTML comment `<!-- … -->` (through the first `-->`). */
export declare function matchHtmlComment(html: string, i: number): number;
/**
 * Mask every token (per `match`) that begins at element position, replacing it
 * with `placeholder(token, index)`. Returns the rewritten string plus the ordered
 * list of removed tokens. Restore by replacing each placeholder with `tokens[i]`.
 *
 * Note: HTML attributes do not use backslash escaping, so a `"`/`'` always
 * toggles the surrounding quote — matching how browsers parse attribute values.
 */
export declare function maskAtElementPosition(html: string, match: TokenMatcher, placeholder: (token: string, index: number) => string): { output: string, tokens: string[] };
/**
 * Stash genuine `<script>…</script>` ELEMENTS behind NUL-byte sentinels so a
 * component scanner doesn't mis-resolve tag-like JS string literals (e.g.
 * `div.innerHTML = '<v:shape>'`) as component references (stacksjs/stx#1730), and
 * so an attribute-embedded `<script>` is never pulled out and restored unescaped.
 */
export declare function stashScriptElements(html: string): { output: string, scripts: string[] };
/** Restore scripts stashed by {@link stashScriptElements}. */
export declare function restoreStashedScripts(html: string, scripts: string[]): string;
/**
 * Element-position-aware masking.
 *
 * Several pipeline stages temporarily replace `<script>…</script>` bodies or
 * `<!-- … -->` comments with sentinel placeholders so later passes don't process
 * their contents, then restore them at the end. A naive global regex
 * (`/<script…>…<\/script>/g`, `/<!--…-->/g`) also matches such a token when it
 * appears INSIDE a quoted attribute value — e.g. `aria-label="<script>x</script>"`
 * or `title="<!-- "><img onerror=alert(1)> -->"`. The renderer's HTML-escaping
 * then runs against the harmless placeholder, and the raw token is restored into
 * the attribute afterward, breaking out of it — an XSS.
 *
 * `maskAtElementPosition` walks the string tracking tag/attribute/quote state and
 * only masks tokens that begin at *element position* (not within an open tag, not
 * inside a quoted attribute value). A token embedded in an attribute is left in
 * place to be escaped normally.
 *
 * This is a leaf module (no stx imports) so any stage can use it without risking
 * an import cycle.
 *
 * @module html-masking
 */
/**
 * Locate a maskable token starting at `html[i]`.
 * @returns the end index (exclusive) of the token, or -1 if none starts here.
 */
export type TokenMatcher = (html: string, i: number) => number;
