/**
 * URL sanitization for component-level defense-in-depth.
 *
 * These helpers run a protocol/MIME allowlist on consumer-supplied URLs
 * before they reach attributes that can execute code (most commonly `<img src>`,
 * `<a href>`, or CSS `url()`). They return the URL unchanged when safe, or
 * `undefined` when the input fails the check — callers should fall back to a
 * safe default (e.g. a generic icon).
 *
 * What we reject:
 *  - `javascript:` / `vbscript:` / `data:text/*` — script execution surfaces
 *  - `file:` — local filesystem access from web context
 *  - URLs with embedded control characters (CR/LF/TAB) that some parsers strip
 *
 * What we allow (image context):
 *  - `https:` / `http:`         — standard remote
 *  - `blob:`                    — produced by `URL.createObjectURL`
 *  - `data:image/png`           — inline raster image
 *  - `data:image/jpeg|jpg`      — inline raster image
 *  - `data:image/gif`           — inline raster image
 *  - `data:image/webp`          — inline raster image
 *  - `data:image/svg+xml`       — SVG rendered via `<img>` cannot execute scripts
 *
 * What we allow (href context):
 *  - `https:` / `http:` / `mailto:` / `tel:`
 */
/**
 * Returns the URL if it is safe to use as an image source, otherwise undefined.
 * The caller should render an icon fallback when undefined is returned.
 */
export declare function sanitizeImageUrl(url: string | undefined | null): string | undefined;
/**
 * Returns the URL if it is safe to use as a hyperlink target, otherwise undefined.
 */
export declare function sanitizeHref(url: string | undefined | null): string | undefined;
//# sourceMappingURL=sanitizeUrl.d.ts.map