/**
 * HTML/JS Escape Utilities
 *
 * XSS prevention utilities for rendering user content safely.
 *
 * @module @kya-os/consent/security/escape
 */
/**
 * Escape HTML special characters to prevent XSS
 *
 * Converts characters that have special meaning in HTML to their
 * entity equivalents, making them safe to insert into HTML content.
 *
 * @param text - The text to escape
 * @returns HTML-safe string
 *
 * @example
 * ```typescript
 * escapeHtml('<script>alert("xss")</script>')
 * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
 * ```
 */
export declare function escapeHtml(text: string): string;
/**
 * Escape text for use in HTML attributes
 *
 * More comprehensive escaping than escapeHtml, including backticks
 * and equals signs which can be dangerous in attribute contexts.
 *
 * @param value - The value to escape
 * @returns Attribute-safe string
 *
 * @example
 * ```typescript
 * escapeAttr('value" onclick="alert(1)')
 * // Returns: 'value&quot; onclick&#x3D;&quot;alert(1)'
 * ```
 */
export declare function escapeAttr(value: string): string;
/**
 * Escape text for use in JavaScript strings
 *
 * Uses JSON.stringify to properly escape all special characters
 * that could break out of a JavaScript string context.
 *
 * @param text - The text to escape
 * @returns JS-safe string (without surrounding quotes)
 *
 * @example
 * ```typescript
 * escapeJs('hello\nworld')
 * // Returns: '"hello\\nworld"' (with quotes from JSON.stringify)
 * ```
 */
export declare function escapeJs(text: string): string;
/**
 * Escape text for use in JavaScript, returning value without quotes
 *
 * @param text - The text to escape
 * @returns JS-safe string content (without surrounding quotes)
 *
 * @example
 * ```typescript
 * escapeJsValue('hello\nworld')
 * // Returns: 'hello\\nworld'
 * ```
 */
export declare function escapeJsValue(text: string): string;
/**
 * Escape URL for use in href or src attributes
 *
 * Only allows http, https, and mailto protocols. Returns empty
 * string for dangerous protocols like javascript:.
 *
 * @param url - The URL to escape
 * @returns Safe URL or empty string
 *
 * @example
 * ```typescript
 * escapeUrl('javascript:alert(1)')
 * // Returns: ''
 *
 * escapeUrl('https://example.com/?q=test')
 * // Returns: 'https://example.com/?q=test'
 * ```
 */
export declare function escapeUrl(url: string | undefined): string;
/**
 * Create a safe HTML string from template literals
 *
 * Automatically escapes interpolated values while preserving
 * the template structure.
 *
 * @param strings - Template literal strings
 * @param values - Interpolated values to escape
 * @returns Safe HTML string
 *
 * @example
 * ```typescript
 * const userInput = '<script>alert("xss")</script>';
 * const html = safeHtml`<div>${userInput}</div>`;
 * // Returns: '<div>&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;</div>'
 * ```
 */
export declare function safeHtml(strings: TemplateStringsArray, ...values: unknown[]): string;
/**
 * Create a safe attribute value from template literals
 *
 * @param strings - Template literal strings
 * @param values - Interpolated values to escape
 * @returns Safe attribute string
 */
export declare function safeAttr(strings: TemplateStringsArray, ...values: unknown[]): string;
//# sourceMappingURL=escape.d.ts.map