import type { RichTextFeatures, RichTextPreset } from './types.js';
/**
 * Per-preset DOMPurify configuration. This is the single source of truth for
 * what HTML is allowed to enter the editor (on paste), leave it (on output),
 * and be rendered by the viewer.
 *
 * NOTE: this module intentionally has NO Tiptap/ProseMirror import so the
 * viewer (and any HTML-only consumer) can sanitize without pulling the editor
 * engine into its bundle.
 */
type SanitizeConfig = {
    ALLOWED_TAGS: string[];
    ALLOWED_ATTR: string[];
    ALLOW_DATA_ATTR?: boolean;
};
export declare const SANITIZE_CONFIGS: Record<RichTextPreset, SanitizeConfig>;
/**
 * `<iframe>`s are permitted only with an `https:` source (blocks javascript:,
 * data:, and plain http: embeds). This is what makes allowing iframes safe-ish
 * for a trusted-author document; YouTube embeds satisfy it too.
 */
export declare const SAFE_IFRAME_SRC_RE: RegExp;
/** Feature flags that widen the schema and therefore the whitelist. */
export type SanitizeFeatures = Pick<RichTextFeatures, 'image' | 'variables' | 'mentions'>;
/**
 * Sanitize an HTML string for the given preset (+ feature overrides — pass the
 * same `features` you gave `getExtensions`/`createEditor` so the whitelist
 * stays in lock-step with the schema). Always strips script/object/embed/style/
 * form/event-handlers and `javascript:` URLs (DOMPurify default). `<iframe>` is
 * allowed ONLY for the document preset and ONLY with an `https:` source
 * (YouTube, Vimeo, Loom, Slides, … survive save/render; unsafe embeds are
 * dropped). `style` is capped to color/background-color/text-align.
 */
export declare function sanitize(html: string | null | undefined, preset?: RichTextPreset, features?: SanitizeFeatures): string;
export {};
//# sourceMappingURL=sanitizer.d.ts.map