export declare function escHtml(value: unknown): string;
export declare function attrEsc(value: unknown): string;
/**
* Serialise a value as JSON and escape the four byte sequences that are
* unsafe inside a `... (use scriptLiteral)
*
*
* data-* attributes (callers should additionally HTML-escape)
*/
export declare function jsonInject(value: unknown): string;
/**
* Embed a JS literal (string, number, boolean, object, array) inside an
* inline ` blocks (matches open/close pair, case-insensitive)
* - blocks (active CSS injection; styles should ship via assets)
* - javascript:/vbscript: URIs in href/src of real HTML tags
*
* Intentionally NOT a general-purpose HTML sanitizer. The on*=event-handler
* stripping pattern was tried and removed: regex can't reliably distinguish a
* real `onclick="..."` attribute from attrEsc-escaped text like
* `content="<img onerror=alert(1)>"` (the literal sequence ` onerror=`
* matches in both cases). Plugin authors are responsible for not emitting
* event handlers; the trust model + sanitised