/**
 * HTML sanitization pre-pass. The ProseMirror schema is the real whitelist —
 * anything it can't parse is dropped — but this pass removes actively
 * dangerous content (scripts, event handlers, javascript: URLs) before the
 * string ever touches a live DOM, and strips style declarations down to the
 * set the schema understands.
 */
export declare function isSafeUrl(url: string, allowDataImage?: boolean): boolean;
/**
 * Sanitizes the CSS inside a <style> block. Neutralizes the vectors that make
 * a raw stylesheet dangerous while leaving ordinary rules intact:
 *  - `@import` (external fetch / data exfiltration) — removed,
 *  - `expression()`, `behavior:`, `-moz-binding:` (script execution) — broken,
 *  - `url(...)` pointing anywhere other than a safe data: image or a local
 *    `#fragment` — replaced with `url(#)`,
 *  - any `</style` sequence — stripped so the text can't break out of the
 *    element when the document is re-serialized.
 * CSS comments are dropped first so none of the above can hide inside one.
 */
export declare function sanitizeCss(css: string): string;
/**
 * Sanitizes an HTML string. Parsing happens in an inert document created by
 * DOMParser, so embedded scripts never execute and images never load.
 */
export declare function sanitizeHtml(html: string): string;