/**
 * Security utilities for HTML sanitization.
 * All DOM writes are sanitized by default to prevent XSS attacks.
 *
 * @module bquery/security
 */
import type { SanitizedHtml } from './trusted-html';
import type { SanitizeOptions } from './types';
export { generateNonce } from './csp';
export { isTrustedTypesSupported } from './trusted-types';
export { trusted } from './trusted-html';
export type { SanitizedHtml, TrustedHtml } from './trusted-html';
/**
 * Sanitize HTML string, removing dangerous elements and attributes.
 *
 * Returns a branded sanitized string. The framework's own DOM-write sinks
 * (`$el.html()`, `.append()`/`.before()`/`.after()`, `bq-html`, …) route
 * through {@link trustedHtmlForSink}, so they produce a Trusted Types value
 * under an enforced `require-trusted-types-for 'script'` CSP. If you assign
 * this string to a sink yourself, wrap it with `trustedHtmlForSink` (or your
 * own policy) to satisfy enforced Trusted Types.
 *
 * @param html - The HTML string to sanitize
 * @param options - Sanitization options
 * @returns Sanitized HTML string
 *
 * @example
 * ```ts
 * const safe = sanitizeHtml('<div onclick="alert(1)">Hello</div>');
 * // Returns: '<div>Hello</div>'
 * ```
 */
export declare const sanitizeHtml: (html: string, options?: SanitizeOptions) => SanitizedHtml;
/**
 * Escape HTML entities to prevent XSS.
 * Use this for displaying user content as text.
 *
 * @param text - The text to escape
 * @returns Escaped HTML string
 *
 * @example
 * ```ts
 * escapeHtml('<script>alert(1)</script>');
 * // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
 * ```
 */
export declare const escapeHtml: (text: string) => string;
/**
 * Strip all HTML tags and return plain text.
 *
 * @param html - The HTML string to strip
 * @returns Plain text content
 */
export declare const stripTags: (html: string) => string;
export type { SanitizeOptions } from './types';
//# sourceMappingURL=sanitize.d.ts.map