/**
 * URL sanitization helpers used by accessibility sinks (shadow `<a>` elements,
 * `window.open`, Markdown link renders, …) to prevent `javascript:` / `data:`
 * URI-script injection.
 *
 * The goal is conservative: allow safe browsing/navigation schemes, rewrite
 * everything else to a benign `#` placeholder so click handlers resolve without
 * executing payload or compromising the host DOM.
 */
/**
 * Sanitize a potentially untrusted `href` / URL string for projection onto
 * an `<a>` element or a `window.open` call.
 *
 * Behaviour:
 * 1. Returns `''` for `null`/`undefined`/non-string input.
 * 2. Trims leading whitespace (browsers do this before scheme resolution).
 * 3. If the URL is relative (no scheme, or starts with `#`, `?`, `/`, `./`),
 *    returns it verbatim — relative navigation is never script-injectable.
 * 4. If the URL parses with a scheme NOT in {@link SAFE_SCHEMES} — after HTML
 *    character references are decoded, so an entity-encoded payload cannot
 *    smuggle a scheme past the check — returns `'#'` to keep the link non-empty
 *    but inert.
 * 5. Otherwise returns the trimmed input unchanged (no canonicalization).
 *
 * The function never throws; malformed input falls back to `'#'`.
 */
export declare function sanitizeUrl(href: string | null | undefined): string;
/**
 * Narrower guard used by link renderers that already know they hold an
 * absolute URL: returns `true` if `urlStr` uses a scheme in
 * {@link SAFE_SCHEMES}, `false` otherwise. Relative URLs are considered safe.
 */
export declare function isSafeUrl(urlStr: string): boolean;