/**
 * Lightweight HTML sanitizer for client-side use.
 *
 * Security model:
 * - RSC HTML from React's renderToString() is trusted (auto-escapes user content)
 * - Error messages and debug info are untrusted and must be escaped
 * - validateTrustedHtml() provides defense-in-depth for server HTML
 */
export declare function escapeInlineJsonText(value: string): string;
export declare function jsonForInlineScript(value: unknown, space?: string | number): string;
export declare function buildTrustedHtmlValidatorScript(): string;
interface ValidateTrustedHtmlOptions {
    /** Throw on suspicious patterns even in dev mode */
    strict?: boolean;
    /** Log warnings for suspicious patterns */
    warn?: boolean;
    /** Allow framework-emitted script tags in trusted navigation HTML */
    allowInlineScripts?: boolean;
}
/**
 * Validate trusted HTML from server (defense-in-depth).
 *
 * This is NOT a full sanitizer - server-rendered RSC content is trusted.
 * This catches scenarios where the server might be compromised or misconfigured.
 *
 * @param html - HTML string from server
 * @param options - Validation options
 * @returns The original HTML if valid
 * @throws Error if suspicious patterns detected in strict mode or production
 */
export declare function validateTrustedHtml(html: string, options?: ValidateTrustedHtmlOptions): string;
/**
 * Create an error display element safely using DOM APIs.
 * Use this instead of innerHTML for displaying error messages.
 */
export declare function createErrorDisplay(options: {
    title: string;
    message: string;
    details?: string;
    style?: Partial<CSSStyleDeclaration>;
}): HTMLDivElement;
export {};
//# sourceMappingURL=html-sanitizer.d.ts.map