/**
* Tags the TEXT pre-pass forwards as raw HTML. Anything outside this set
* (plus per-composition `extraAllowedHtmlTags`) gets its angle brackets
* escaped and renders as plain text.
*
* `video` is deliberately NOT in the baseline: chat strips
* server-side and playback goes through the SSOT. The rich
* composition opts back in via `extraAllowedHtmlTags={['video', 'source']}`
* so authored content (blog publisher video injection) keeps working.
*/
export declare const SAFE_HTML_TAGS: Set;
/**
* Inline SVG element set, in the CANONICAL case parse5 produces for SVG
* foreign content (`linearGradient`, `clipPath`, … are camelCase in the
* HTML parser's SVG adjustment table, so the sanitize schema must match
* that spelling; the text pre-pass lowercases before lookup).
*
* Inline `` renders in real published posts (hand-authored diagrams
* and inline icon markup — NOT `` sprite references, which are
* deliberately dropped; see SVG_ATTRIBUTES). The Rich renderer had NO pre-pass
* and NO sanitizer, so it always rendered; without this set the unified
* engine would escape it to visible source text.
*
* SEVERAL OF THESE NAMES ARE ALSO HTML ELEMENTS (`title`, `desc`, `text`,
* `g`, `line`, `use`, `symbol`, `marker`, `mask`, `pattern`) — admitting
* them UNCONSTRAINED let a post or a chat message emit a bare ``,
* which React 19 hoists into `<head>` (browser-tab + SEO title hijack) and
* whose RAWTEXT content model swallows the rest of the document when
* unclosed. They are therefore pinned to an `svg` ancestor in
* `SVG_ONLY_ANCESTORS` below; outside `<svg>` the sanitizer drops them.
*/
export declare const SVG_TAGS: Set<string>;
/** Effective pre-pass tag set for a composition (lowercased for lookup). */
export declare function buildEffectiveTagSet(extraAllowedHtmlTags?: string[]): Set<string>;
export interface BuildSanitizeSchemaOptions {
extraAllowedHtmlTags?: string[];
}
/**
* The engine's sanitize schema: defaultSchema ∪ SAFE_HTML_TAGS ∪ extras.
* - `extraAllowedHtmlTags` is unioned into tagNames here AND into the
* pre-pass set (buildEffectiveTagSet) — the coupled-allowlist invariant.
* - `clobberPrefix: ''` + empty `clobber`: authored raw-HTML anchors
* (`<h2 id="…">`) keep their ids so `[jump](#anchor)` deep-links work.
* (The renderer's own heading ids are injected at the React layer,
* post-rehype, and were never affected.)
* - `card`/`mention` protocols registered for href so chat markers survive
* (the urlTransform below is the second gate).
*/
export declare function buildSanitizeSchema(options?: BuildSanitizeSchemaOptions): {
tagNames: string[];
attributes: Record<string, (string | [string, ...unknown[]])[]>;
ancestors: Record<string, string[]>;
required: Record<string, Record<string, unknown>>;
clobberPrefix: string;
clobber: never[];
protocols: {
href: string[];
};
allowComments?: boolean | null | undefined;
allowDoctypes?: boolean | null | undefined;
strip?: Array<string> | null | undefined;
};
export declare function rehypeStripUnsafe(): (tree: any) => void;
/**
* PARAGRAPH SEGMENTS, NOT LINES (round 18 — SECURITY). A CommonMark code span
* CROSSES LINE BREAKS: `` `foo\n</textarea>` `` is one `inlineCode` node, so
* that `</textarea>` is a code sample and not a closer — yet this scan (and
* `PROTECTED_SPAN_RE`, whose body class is `[^\n]`) was strictly PER LINE, so
* the mask never saw the span, the closer stayed visible in the haystack,
* `hasLaterCloser` returned true, and a prose `<textarea>` above it stayed LIVE
* (`escapeUnknownHtmlTags` returned the input BYTE-IDENTICAL; the renderer
* emitted `<code>foo </textarea></code>` — proving the closer is a code sample
* — beside a live textarea swallowing the prose). This is the shape that is not
* a CONTAINER at all, so no container sweep could ever have reached it.
*
* A code span CANNOT cross a paragraph break, so the scan unit is a maximal run
* of non-blank lines. Blank lines still terminate a segment, which keeps the
* fail-CLOSED direction (an unterminated opener consumes at most its own
* paragraph, never the rest of the document) and keeps the bound linear — the
* `suffMax` / cursor structure is unchanged, `\n` is simply an ordinary
* character inside a segment.
*
* `PROTECTED_SPAN_RE` (the CARVE) is deliberately left per-line: it rounds the
* other way, so at worst a multi-line code sample renders as escaped text.
*/
declare function findInlineCodeRanges(source: string): Array<[number, number]>;
/** Exported for the differential fuzz against the retired regex. */
export declare const __findInlineCodeRangesForTest: typeof findInlineCodeRanges;
/**
* Build the haystack `hasLaterCloser` searches: a LENGTH-PRESERVING lowercased
* copy of the document with every region that cannot contain a REAL closing
* tag blanked to spaces.
*
* Why this exists: the escaping pass carefully carves code out, but the
* closer search used to run over the RAW document. So a `</textarea>` sitting
* inside a code fence, an inline-code span, or another tag's attribute string
* satisfied "is closed later", the prose opener was left LIVE, and parse5's
* RAWTEXT span swallowed the rest of the message anyway — the whole fix was
* one code sample away from being bypassed, which is exactly what an LLM
* answer about HTML looks like.
*
* Masking (rather than deleting) keeps every index identical to the original
* string, so the caller's offset arithmetic is unchanged. THE LENGTH
* INVARIANT IS LOAD-BEARING — see `foldAsciiCase`.
*
* CARVE DECISION (deliberate, do not "unify"): these tracker-derived regions
* are NOT fed to the escaping carve, even though that would stop an authored
* EOF-terminated fence body from rendering as literal `<their>`.
*
* The genuine asymmetry is the EOF-TERMINATED fence, and only that one. The
* tracker protects an unclosed opener all the way to end of input, so a single
* stray ``` line — mid-stream, or inside an open raw-HTML block where a ```
* line is content rather than a fence — would carve the ENTIRE remainder of the
* document out of the escaping pass. `PROTECTED_SPAN_RE` protects nothing at
* all there (it only recognizes a fence CLOSED by a same-marker run), so its
* failure mode is bounded: a code sample renders as escaped text. In the carve
* an over-detected region is a region that is NOT escaped — a fail-OPEN, i.e.
* exactly the swallow this module exists to prevent — so the materially larger
* fail-open surface decides it.
*
* SHARED over-detection (e.g. a ``` line inside an HTML block — `<div>`,
* `<pre>`, `<details>` — where CommonMark says the line is HTML content, not a
* fence) was previously dismissed here as "not an argument either way". THAT
* WAS WRONG: it is precisely the residual fail-open. The intersection guard
* below only reconciles DISAGREEMENT, so when BOTH engines open the same bogus
* fence the guard is a no-op and a live `<textarea>` inside it is pushed
* verbatim, swallowing the rest of the message (reproduced for all three tags).
* What actually closes it is the CARVE BALANCE GUARD in
* `escapeUnknownHtmlTags`: a protected span may contain no UNBALANCED RAWTEXT
* opener. Neither engine needs to learn about HTML blocks for that to hold.
*
* What makes keeping two engines SAFE is therefore the pair of guards in
* `escapeUnknownHtmlTags`: a carve span the mask did not blank is escaped
* rather than pushed through verbatim, and a span carrying an unbalanced
* RAWTEXT opener is escaped even when both engines agree. Over-detection can
* then only cost cosmetics. Before the first guard the regex's info-string-tolerant
* closer let it desync and open a span from a line CommonMark treats as
* ordinary text, sheltering a live `<textarea>` from escaping entirely
* (`mismatched-fence-carve-does-not-shelter-opener`). The remaining tradeoff is
* pinned by `unclosed-fence-body-renders-escaped` rather than left as prose.
*/
declare function buildCloserHaystack(text: string): string;
/** Exported for the length-preservation invariant test only. */
export declare const __buildCloserHaystackForTest: typeof buildCloserHaystack;
export declare function escapeUnknownHtmlTags(text: string, allowedTags?: Set<string>): string;
/**
* Extends react-markdown's default safe-protocol allowlist with the two
* internal schemes the chat remark plugins emit (`card://`, `mention://`),
* for `href` ONLY. All other URLs go through `defaultUrlTransform`.
*/
export declare function cardAwareUrlTransform(url: string, key: string): string;
export {};
//# sourceMappingURL=sanitize.d.ts.map