/**
 * Sanitize + scope + validate author-supplied custom CSS before it is injected
 * into the document.
 *
 * Authors write **normal, full-page CSS** — `body { … }`, `html body h1 { … }`,
 * `h1 { … }`, `* { … }` — the way they'd style any web page. We transparently
 * scope every rule to the document so it can't leak into the app, AND we map the
 * page-root selectors (`html`, `body`, `:root`) onto the document root so that
 * `body { background: … }` styles the doc surface and `html body h1 { … }`
 * styles the doc's headings. No `.ProseMirror` prefix, no learning curve.
 *
 * Because the raw string reaches VIEWERS of a published doc, it is untrusted.
 * Every selector is force-scoped (so a `}` breakout is neutralised — the escaped
 * rule is simply scoped too), and dangerous declarations are stripped:
 *  - external resource loads / exfiltration: `url(…)`, `@import`;
 *  - clickjacking / UI redressing: `position: fixed | sticky`;
 *  - legacy script vectors: `expression()`, `-moz-binding`, `behavior:`.
 *
 * We parse with the browser's own CSS engine (no dependency), rewrite each
 * selector, strip dangerous declarations at every nesting level, and let the
 * engine re-serialise — so the output is always a valid, balanced stylesheet.
 *
 * The sanitizer knows exactly what it removed, so it returns non-blocking
 * `diagnostics`; the editing UI surfaces them (CSS is forgiving — we warn,
 * never block).
 */
export interface CssDiagnostic {
    level: 'warning' | 'error';
    message: string;
}
export interface CssValidationResult {
    /** Sanitized, scoped CSS, safe to inject. '' when nothing survives. */
    css: string;
    /** What was stripped/ignored, deduped. Empty when the CSS was fully clean. */
    diagnostics: CssDiagnostic[];
}
/**
 * Sanitize + scope AND report. Use this from the editing UI for diagnostics.
 */
export declare const validateCustomCss: (raw: string | undefined | null, scope?: string) => CssValidationResult;
/**
 * Sanitized + scoped CSS only — used at injection/export sinks that just need
 * the safe string. Diagnostics are surfaced separately via validateCustomCss.
 */
export declare const sanitizeCustomCss: (raw: string | undefined | null, scope?: string) => string;