/**
 * Sanitize a URL for safe use in an `href` or `src` attribute.
 *
 * Allows http(s), protocol-relative (`//host`), and relative URLs. Anything
 * with a dangerous scheme (`javascript:`, `data:`, `vbscript:`, etc.) is
 * rejected and the `fallback` is returned instead. Control characters that can
 * be used to smuggle a scheme (e.g. `java\tscript:`) are stripped first.
 */
export declare function sanitizeUrl(url: string | undefined | null, fallback?: string): string;
/**
 * Sanitize untrusted annotation HTML with DOMPurify.
 *
 * Used both at the source (`<vz-annotation>` parsing) and the render sink
 * (annotation popup) so the stored content is never an XSS vector regardless of
 * which consumer reads it. `style` is intentionally NOT allowed (avoids
 * CSS-based exfiltration); `onerror`/`onload`/etc. are stripped by DOMPurify.
 */
export declare function sanitizeAnnotationHtml(html: string): string;
//# sourceMappingURL=sanitize.d.ts.map