import { TranslatableMessage } from './i18nMessage';
export interface SvgSanitizeResult {
    ok: boolean;
    svg?: string;
    /**
     * Message key and params, not a shown string — this module has no
     * injector access. Translated at the point of display in
     * `sidebarTree.component.ts`.
     */
    warning?: TranslatableMessage;
    error?: TranslatableMessage;
}
/**
 * Sanitizer for user-imported custom SVG icons.
 *
 * Tabby's own `<profile-icon>` renders any icon string starting with `<` via
 * `FastHtmlBindDirective`, which does a raw `element.innerHTML = value` in
 * TypeScript — this bypasses Angular's DomSanitizer entirely (that only ever
 * runs on template `[innerHTML]` bindings, not on an imperative DOM
 * assignment), and nothing sanitizes upstream (see roadmap item 2 / piège
 * #13). So this plugin never stores or displays a user-supplied SVG string
 * as-is. Uses DOMPurify (Cure53, MIT/Apache-2.0, widely audited) rather than
 * a hand-rolled parser — writing our own XSS sanitizer is exactly the kind
 * of security-critical code better delegated to a maintained, reviewed
 * library. `USE_PROFILES: {svg: true}` makes DOMPurify parse/serialize in
 * SVG (case-sensitive, e.g. `viewBox`) rather than HTML mode; the explicit
 * ALLOWED_TAGS/ALLOWED_ATTR then restrict DOMPurify's already-broad SVG
 * profile down to plain icon shapes only.
 */
export declare function sanitizeSvgIcon(raw: string): SvgSanitizeResult;