purifai 1.0.0 → 2.0.0

package/dist/index.cjs

@@ -23,6 +23,9 @@ __export(index_exports, {
   Purifai: () => Purifai,
   analyze: () => analyze,
   default: () => index_default,
+  escape: () => escape,
+  escapeAttribute: () => escapeAttribute,
+  escapeUrl: () => escapeUrl,
   isDangerous: () => isDangerous,
   sanitize: () => sanitize,
   sanitizeBatch: () => sanitizeBatch
@@ -38,68 +41,256 @@ var NULL_CONTROL_CHARS = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F]/g;
 var POLYGLOT_JAVASCRIPT = /j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*:/gi;
 var POLYGLOT_EVENTS = /o\s*n\s*[a-z]+\s*(?:=|alert)/gi;
 var ENCODED_TAGS = /\\x3c|\\x3e|%3c|%3e/gi;
-var SUSPICIOUS_PATTERNS = /<|>|javascript:|vbscript:|on\w+\s*=|@import|\{\{|<%|<\?|\${|#\{/i;
+var SUSPICIOUS_PATTERNS = /<|>|javascript:|vbscript:|\bon[a-z]+\s*=|@import|\{\{|<%|<\?|\${|#\{/i;
+var DANGEROUS_PROTOCOL_TOKEN = /(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t|v\s*b\s*s\s*c\s*r\s*i\s*p\s*t|l\s*i\s*v\s*e\s*s\s*c\s*r\s*i\s*p\s*t|m\s*o\s*c\s*h\s*a)\s*:|data\s*:\s*text\/html/i;
+var HAS_TEXT_CONTENT = /[a-z0-9]/i;
+var HTML_TAG = /<\/?[a-zA-Z][^>]*>/g;
+function escapeAngleBrackets(str) {
+  return str.replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function stateless(pattern) {
+  return new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
+}
+var DETECT_DANGEROUS_TAGS = stateless(DANGEROUS_TAGS_WITH_CONTENT);
+var DETECT_EVENT_HANDLERS = stateless(EVENT_HANDLERS_ENHANCED);
+var DETECT_DANGEROUS_PROTOCOLS = stateless(DANGEROUS_PROTOCOLS_ENHANCED);
+var DETECT_DANGEROUS_ATTRIBUTES = stateless(DANGEROUS_ATTRIBUTES);
+var DETECT_TEMPLATE_INJECTION = stateless(TEMPLATE_INJECTION);
+var DETECT_POLYGLOT_JAVASCRIPT = stateless(POLYGLOT_JAVASCRIPT);
+var DETECT_POLYGLOT_EVENTS = stateless(POLYGLOT_EVENTS);
+var DEFAULT_OPTIONS = {
+  maxLength: 1e6,
+  // 1MB
+  allowedProtocols: ["http", "https", "mailto"],
+  aggressiveMode: true
+};
+var VERSION = "2.0.0";
+var MAX_FILTER_PASSES = 5;
+function decodeEncodingBypasses(str) {
+  let result = str;
+  try {
+    result = decodeURIComponent(result);
+  } catch {
+  }
+  try {
+    result = result.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => {
+      return String.fromCharCode(parseInt(hex, 16));
+    });
+    result = result.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => {
+      return String.fromCharCode(parseInt(hex, 16));
+    });
+    result = result.replace(/&#(\d+);/g, (_, num) => {
+      return String.fromCharCode(parseInt(num, 10));
+    });
+    result = result.replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => {
+      return String.fromCharCode(parseInt(hex, 16));
+    });
+  } catch {
+  }
+  return result;
+}
+function removeDangerousTagsWithContent(str) {
+  return str.replace(DANGEROUS_TAGS_WITH_CONTENT, "");
+}
+function handlePolyglotAttacks(str) {
+  let result = str;
+  try {
+    result = result.replace(POLYGLOT_JAVASCRIPT, "");
+    result = result.replace(POLYGLOT_EVENTS, "");
+    result = result.replace(ENCODED_TAGS, "");
+    result = result.replace(/javascript\s*:\s*\/\*[\s\S]*?\*\//gi, "");
+    result = result.replace(/javascript\s*:\s*\/\*[^*]*\*\/[^>]*/gi, "");
+    result = result.replace(/<form[^>]*>[\s\S]*?<\/form>/gi, "");
+    result = result.replace(/<math[^>]*>[\s\S]*?<\/math>/gi, "");
+    result = result.replace(/%0[AD]/gi, "");
+    if (/svg|sVg|\x3c|\\\w{3}/i.test(result)) {
+      result = result.replace(/svg[^>]*>/gi, "");
+      result = result.replace(/sVg[^>]*>/gi, "");
+      result = result.replace(/\\x\w{2}/gi, "");
+      result = result.replace(/<\/[^>]*>/gi, "");
+      result = result.replace(/<[^>]*>/gi, "");
+    }
+  } catch {
+    result = result.replace(/<[^>]*>/g, "").replace(/[<>]/g, "");
+  }
+  return result;
+}
+function assessThreatLevel(input) {
+  if (!input) return "none";
+  if (/<script/i.test(input) || /javascript\s*:/i.test(input) || /\bon[a-z]+\s*=/i.test(input)) {
+    return "critical";
+  }
+  if (/<(iframe|object|embed|form|svg|math)/i.test(input) || /eval\s*\(/i.test(input)) {
+    return "high";
+  }
+  if (/<(style|link|meta)/i.test(input) || /expression\s*\(/i.test(input)) {
+    return "medium";
+  }
+  if (/<[^>]*>/i.test(input)) {
+    return "low";
+  }
+  return "none";
+}
+function isDangerous(input) {
+  if (!input) return false;
+  try {
+    return DETECT_DANGEROUS_TAGS.test(input) || DETECT_EVENT_HANDLERS.test(input) || DETECT_DANGEROUS_PROTOCOLS.test(input) || DETECT_DANGEROUS_ATTRIBUTES.test(input) || DETECT_TEMPLATE_INJECTION.test(input) || DETECT_POLYGLOT_JAVASCRIPT.test(input) || DETECT_POLYGLOT_EVENTS.test(input) || DANGEROUS_PROTOCOL_TOKEN.test(input);
+  } catch {
+    return true;
+  }
+}
+function sanitize(input, options) {
+  const config = { ...DEFAULT_OPTIONS, ...options };
+  if (input === null || input === void 0) return "";
+  let str;
+  try {
+    if (typeof input === "string") {
+      str = input;
+    } else if (typeof input === "object") {
+      str = JSON.stringify(input);
+    } else {
+      str = String(input);
+    }
+  } catch {
+    return "";
+  }
+  if (str.length > config.maxLength) {
+    str = str.substring(0, config.maxLength);
+  }
+  if (!str.trim()) return "";
+  let result = str.replace(NULL_CONTROL_CHARS, "");
+  try {
+    result = decodeEncodingBypasses(result);
+    const dangerous = isDangerous(str) || isDangerous(result);
+    if (!dangerous) {
+      const benign = removeDangerousTagsWithContent(result).replace(HTML_TAG, "").replace(DANGEROUS_ATTRIBUTES, "").replace(TEMPLATE_INJECTION, "").replace(DANGEROUS_FUNCTIONS, "");
+      return escapeAngleBrackets(benign).replace(/\s+/g, " ").trim();
+    }
+    result = removeDangerousTagsWithContent(result);
+    result = handlePolyglotAttacks(result);
+    let previous;
+    let passes = 0;
+    do {
+      previous = result;
+      result = result.replace(DANGEROUS_TAGS_WITH_CONTENT, "").replace(EVENT_HANDLERS_ENHANCED, "").replace(DANGEROUS_PROTOCOLS_ENHANCED, (match) => {
+        const safeProtocols = config.allowedProtocols.join("|");
+        return match.match(new RegExp(`^(?:href|src)\\s*=\\s*["']?\\s*(?:${safeProtocols}):\\/\\/`, "i")) ? match : "";
+      }).replace(DANGEROUS_ATTRIBUTES, "").replace(TEMPLATE_INJECTION, "").replace(DANGEROUS_FUNCTIONS, "");
+      passes++;
+    } while (result !== previous && passes < MAX_FILTER_PASSES);
+    if (config.aggressiveMode && SUSPICIOUS_PATTERNS.test(result)) {
+      const tempCheck = result.replace(/<[^>]*>/g, "");
+      if (SUSPICIOUS_PATTERNS.test(tempCheck)) {
+        result = result.replace(/<[^>]*>/g, "").replace(/[<>]/g, "").replace(/javascript|vbscript/gi, "").replace(/\bon[a-z]+\s*=/gi, "").replace(/svg|SVG|sVg/gi, "").replace(/script|SCRIPT/gi, "").replace(/alert|eval/gi, "").replace(/\\x\w{2}/gi, "").replace(/[(){}[\]]/g, "");
+      }
+    }
+    result = result.replace(/\s+/g, " ").trim();
+    if (config.aggressiveMode && !HAS_TEXT_CONTENT.test(result)) {
+      return "";
+    }
+    return escapeAngleBrackets(result);
+  } catch {
+    return str.replace(NULL_CONTROL_CHARS, "").replace(/<[^>]*>/g, "").replace(/[<>]/g, "").replace(/javascript|vbscript|eval|alert/gi, "").replace(/\bon[a-z]+\s*=/gi, "").replace(/\s+/g, " ").trim();
+  }
+}
+function analyze(input, options) {
+  const startTime = performance.now();
+  const originalStr = String(input ?? "");
+  const sanitized = sanitize(input, options);
+  const processingTime = performance.now() - startTime;
+  const hadThreats = sanitized !== originalStr;
+  const threatLevel = assessThreatLevel(originalStr);
+  return {
+    content: sanitized,
+    hadThreats,
+    processingTime,
+    threatLevel
+  };
+}
+function sanitizeBatch(inputs, options) {
+  return inputs.map((input) => {
+    try {
+      return sanitize(input, options);
+    } catch {
+      return "";
+    }
+  });
+}
+function escape(input) {
+  if (input === null || input === void 0) return "";
+  const str = typeof input === "string" ? input : String(input);
+  return str.replace(NULL_CONTROL_CHARS, "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function escapeAttribute(input) {
+  if (input === null || input === void 0) return "";
+  const str = (typeof input === "string" ? input : String(input)).replace(NULL_CONTROL_CHARS, "");
+  let out = "";
+  for (const char of str) {
+    const code = char.codePointAt(0);
+    if (/[a-zA-Z0-9]/.test(char)) {
+      out += char;
+    } else if (code < 256) {
+      out += `&#x${code.toString(16).padStart(2, "0")};`;
+    } else {
+      out += `&#x${code.toString(16)};`;
+    }
+  }
+  return out;
+}
+function escapeUrl(input, options) {
+  if (input === null || input === void 0) return "";
+  const config = { ...DEFAULT_OPTIONS, ...options };
+  const str = (typeof input === "string" ? input : String(input)).trim();
+  if (!str) return "";
+  const normalized = str.replace(/[\x00-\x20\x7F-\x9F]/g, "");
+  const colon = normalized.indexOf(":");
+  if (colon !== -1) {
+    const beforeColon = normalized.slice(0, colon);
+    if (!/[/?#]/.test(beforeColon)) {
+      const protocol = beforeColon.toLowerCase();
+      if (!config.allowedProtocols.map((p) => p.toLowerCase()).includes(protocol)) {
+        return "";
+      }
+    }
+  }
+  return escapeAttribute(normalized);
+}
+function getVersion() {
+  return VERSION;
+}
+function getStats() {
+  return {
+    version: getVersion(),
+    securityLevel: "100% XSS Protection",
+    performance: "Optimized for high-throughput"
+  };
+}
 var Purifai = class {
   /**
    * Sanitize input with maximum security protection
-   * 
+   *
    * @param input - Content to sanitize (string, object, or any type)
    * @param options - Optional configuration
    * @returns Sanitized string safe for HTML output
-   * 
+   *
    * @example
    * ```typescript
    * import { Purifai } from 'purifai';
-   * 
+   *
    * const clean = Purifai.sanitize('<script>alert("xss")</script>Hello World');
    * console.log(clean); // "Hello World"
    * ```
    */
   static sanitize(input, options) {
-    const config = { ...this.defaultOptions, ...options };
-    if (input === null || input === void 0) return "";
-    let str;
-    try {
-      if (typeof input === "string") {
-        str = input;
-      } else if (typeof input === "object") {
-        str = JSON.stringify(input);
-      } else {
-        str = String(input);
-      }
-    } catch {
-      return "";
-    }
-    if (str.length > config.maxLength) {
-      str = str.substring(0, config.maxLength);
-    }
-    if (!str.trim()) return "";
-    let result = str.replace(NULL_CONTROL_CHARS, "");
-    try {
-      result = this.decodeEncodingBypasses(result);
-      result = this.handlePolyglotAttacks(result);
-      result = result.replace(DANGEROUS_TAGS_WITH_CONTENT, "").replace(EVENT_HANDLERS_ENHANCED, "").replace(DANGEROUS_PROTOCOLS_ENHANCED, (match) => {
-        const safeProtocols = config.allowedProtocols.join("|");
-        return match.match(new RegExp(`^(?:href|src)\\s*=\\s*["']?\\s*(?:${safeProtocols}):\\/\\/`, "i")) ? match : "";
-      }).replace(DANGEROUS_ATTRIBUTES, "").replace(TEMPLATE_INJECTION, "").replace(DANGEROUS_FUNCTIONS, "");
-      if (config.aggressiveMode && SUSPICIOUS_PATTERNS.test(result)) {
-        const tempCheck = result.replace(/<[^>]*>/g, "");
-        if (SUSPICIOUS_PATTERNS.test(tempCheck)) {
-          result = result.replace(/<[^>]*>/g, "").replace(/[<>]/g, "").replace(/javascript|vbscript/gi, "").replace(/on\w+\s*=/gi, "").replace(/svg|SVG|sVg/gi, "").replace(/script|SCRIPT/gi, "").replace(/alert|eval/gi, "").replace(/\\x\w{2}/gi, "").replace(/[(){}[\]]/g, "");
-        }
-      }
-      return result.replace(/\s+/g, " ").trim();
-    } catch (error) {
-      return str.replace(NULL_CONTROL_CHARS, "").replace(/<[^>]*>/g, "").replace(/[<>]/g, "").replace(/javascript|vbscript|eval|alert/gi, "").replace(/on\w+\s*=/gi, "").replace(/\s+/g, " ").trim();
-    }
+    return sanitize(input, options);
   }
   /**
    * Sanitize input and return detailed analysis
-   * 
+   *
    * @param input - Content to sanitize
    * @param options - Optional configuration
    * @returns Detailed sanitization result with threat analysis
-   * 
+   *
    * @example
    * ```typescript
    * const result = Purifai.analyze('<script>alert("xss")</script>Hello');
@@ -109,93 +300,14 @@ var Purifai = class {
    * ```
    */
   static analyze(input, options) {
-    const startTime = performance.now();
-    const originalStr = String(input || "");
-    const sanitized = this.sanitize(input, options);
-    const processingTime = performance.now() - startTime;
-    const hadThreats = sanitized !== originalStr;
-    const threatLevel = this.assessThreatLevel(originalStr);
-    return {
-      content: sanitized,
-      hadThreats,
-      processingTime,
-      threatLevel
-    };
-  }
-  /**
-   * Decode common encoding bypasses
-   */
-  static decodeEncodingBypasses(str) {
-    let result = str;
-    try {
-      result = decodeURIComponent(result);
-      result = result.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => {
-        return String.fromCharCode(parseInt(hex, 16));
-      });
-      result = result.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => {
-        return String.fromCharCode(parseInt(hex, 16));
-      });
-      result = result.replace(/&#(\d+);/g, (_, num) => {
-        return String.fromCharCode(parseInt(num, 10));
-      });
-      result = result.replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => {
-        return String.fromCharCode(parseInt(hex, 16));
-      });
-    } catch {
-    }
-    return result;
-  }
-  /**
-   * Enhanced polyglot attack handling - Addresses sophisticated XSS techniques
-   */
-  static handlePolyglotAttacks(str) {
-    let result = str;
-    try {
-      result = result.replace(POLYGLOT_JAVASCRIPT, "");
-      result = result.replace(POLYGLOT_EVENTS, "");
-      result = result.replace(ENCODED_TAGS, "");
-      result = result.replace(/javascript\s*:\s*\/\*[\s\S]*?\*\//gi, "");
-      result = result.replace(/javascript\s*:\s*\/\*[^*]*\*\/[^>]*/gi, "");
-      result = result.replace(/<form[^>]*>[\s\S]*?<\/form>/gi, "");
-      result = result.replace(/<math[^>]*>[\s\S]*?<\/math>/gi, "");
-      result = result.replace(/%0[AD]/gi, "");
-      if (/svg|sVg|\x3c|\\\w{3}/i.test(result)) {
-        result = result.replace(/svg[^>]*>/gi, "");
-        result = result.replace(/sVg[^>]*>/gi, "");
-        result = result.replace(/\\x\w{2}/gi, "");
-        result = result.replace(/<\/[^>]*>/gi, "");
-        result = result.replace(/<[^>]*>/gi, "");
-      }
-    } catch {
-      result = result.replace(/<[^>]*>/g, "").replace(/[<>]/g, "");
-    }
-    return result;
-  }
-  /**
-   * Assess threat level of input content
-   */
-  static assessThreatLevel(input) {
-    if (!input) return "none";
-    if (/<script/i.test(input) || /javascript\s*:/i.test(input) || /on\w+\s*=/i.test(input)) {
-      return "critical";
-    }
-    if (/<(iframe|object|embed|form|svg|math)/i.test(input) || /eval\s*\(/i.test(input)) {
-      return "high";
-    }
-    if (/<(style|link|meta)/i.test(input) || /expression\s*\(/i.test(input)) {
-      return "medium";
-    }
-    if (/<[^>]*>/i.test(input)) {
-      return "low";
-    }
-    return "none";
+    return analyze(input, options);
   }
   /**
    * Check if input contains dangerous patterns
-   * 
+   *
    * @param input - Content to check
    * @returns true if dangerous content detected
-   * 
+   *
    * @example
    * ```typescript
    * const isDangerous = Purifai.isDangerous('<script>alert("xss")</script>');
@@ -203,20 +315,15 @@ var Purifai = class {
    * ```
    */
   static isDangerous(input) {
-    if (!input) return false;
-    try {
-      return DANGEROUS_TAGS_WITH_CONTENT.test(input) || EVENT_HANDLERS_ENHANCED.test(input) || DANGEROUS_PROTOCOLS_ENHANCED.test(input) || DANGEROUS_ATTRIBUTES.test(input) || TEMPLATE_INJECTION.test(input) || POLYGLOT_JAVASCRIPT.test(input) || POLYGLOT_EVENTS.test(input);
-    } catch {
-      return true;
-    }
+    return isDangerous(input);
   }
   /**
    * Batch sanitize multiple inputs for optimal performance
-   * 
+   *
    * @param inputs - Array of inputs to sanitize
    * @param options - Optional configuration
    * @returns Array of sanitized strings
-   * 
+   *
    * @example
    * ```typescript
    * const cleaned = Purifai.sanitizeBatch([
@@ -227,57 +334,73 @@ var Purifai = class {
    * ```
    */
   static sanitizeBatch(inputs, options) {
-    return inputs.map((input) => {
-      try {
-        return this.sanitize(input, options);
-      } catch {
-        return "";
-      }
-    });
+    return sanitizeBatch(inputs, options);
+  }
+  /**
+   * Escape text for an HTML body context (lossless — nothing is removed)
+   *
+   * @example
+   * ```typescript
+   * Purifai.escape('if (a<b && c>d)'); // "if (a&lt;b &amp;&amp; c&gt;d)"
+   * ```
+   */
+  static escape(input) {
+    return escape(input);
+  }
+  /**
+   * Escape text for an HTML attribute value, safe even when unquoted
+   *
+   * @example
+   * ```typescript
+   * `<div title="${Purifai.escapeAttribute(userInput)}">`
+   * ```
+   */
+  static escapeAttribute(input) {
+    return escapeAttribute(input);
+  }
+  /**
+   * Escape a URL, returning '' if its protocol is not allowed
+   *
+   * @example
+   * ```typescript
+   * Purifai.escapeUrl('javascript:alert(1)'); // ""
+   * Purifai.escapeUrl('https://example.com'); // escaped, safe for href
+   * ```
+   */
+  static escapeUrl(input, options) {
+    return escapeUrl(input, options);
   }
   /**
    * Get version information
    */
   static getVersion() {
-    return "1.0.0";
+    return getVersion();
   }
   /**
    * Get performance and security statistics
    */
   static getStats() {
-    return {
-      version: this.getVersion(),
-      securityLevel: "100% XSS Protection",
-      performance: "Optimized for high-throughput"
-    };
+    return getStats();
   }
 };
-Purifai.defaultOptions = {
-  maxLength: 1e6,
-  // 1MB
-  allowBasicHtml: false,
-  allowedProtocols: ["http", "https", "mailto"],
-  aggressiveMode: true
-};
-var sanitize = Purifai.sanitize;
-var analyze = Purifai.analyze;
-var isDangerous = Purifai.isDangerous;
-var sanitizeBatch = Purifai.sanitizeBatch;
 var index_default = Purifai;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Purifai,
   analyze,
+  escape,
+  escapeAttribute,
+  escapeUrl,
   isDangerous,
   sanitize,
   sanitizeBatch
 });
 /**
  * 🛡️ PURIFAI - Ultra-Secure HTML Sanitizer
- * 
+ *
  * Advanced XSS protection with polyglot attack resistance.
  * Blocks sophisticated obfuscation techniques that bypass other sanitizers.
- * 
- * @version 1.0.0
+ *
+ * @version 2.0.0
  * @license MIT
  */

package/dist/index.d.cts

@@ -4,17 +4,15 @@
  * Advanced XSS protection with polyglot attack resistance.
  * Blocks sophisticated obfuscation techniques that bypass other sanitizers.
  *
- * @version 1.0.0
+ * @version 2.0.0
  * @license MIT
  */
 /**
  * Purifai Configuration Options
  */
-interface PurifaiOptions {
+export interface PurifaiOptions {
     /** Maximum input length (default: 1MB) */
     maxLength?: number;
-    /** Allow safe HTML tags like <b>, <i>, <p> (default: false for maximum security) */
-    allowBasicHtml?: boolean;
     /** Custom allowed protocols (default: ['http', 'https', 'mailto']) */
     allowedProtocols?: string[];
     /** Enable aggressive mode for maximum security (default: true) */
@@ -23,7 +21,7 @@ interface PurifaiOptions {
 /**
  * Purifai Sanitization Result
  */
-interface PurifaiResult {
+export interface PurifaiResult {
     /** Sanitized content */
     content: string;
     /** Whether dangerous content was detected */
@@ -33,14 +31,59 @@ interface PurifaiResult {
     /** Threat level: 'none' | 'low' | 'medium' | 'high' | 'critical' */
     threatLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';
 }
+/**
+ * Check if input contains dangerous patterns
+ */
+declare function isDangerous(input: string): boolean;
+/**
+ * Sanitize input with maximum security protection
+ */
+declare function sanitize(input: unknown, options?: PurifaiOptions): string;
+/**
+ * Sanitize input and return detailed analysis
+ */
+declare function analyze(input: unknown, options?: PurifaiOptions): PurifaiResult;
+/**
+ * Batch sanitize multiple inputs for optimal performance
+ */
+declare function sanitizeBatch(inputs: unknown[], options?: PurifaiOptions): string[];
+/**
+ * Escape text for insertion into an HTML body context.
+ *
+ * Lossless and total: nothing is removed, so this is the correct choice when
+ * the input is plain text rather than markup. `sanitize()` cannot tell the two
+ * apart — `a<b && c>d` is a valid HTML start tag by the parsing spec, so
+ * `sanitize()` drops it while `escape()` preserves it verbatim.
+ */
+declare function escape(input: unknown): string;
+/**
+ * Escape text for insertion into an HTML attribute value.
+ *
+ * Stricter than `escape()`: every character outside `[a-zA-Z0-9]` is
+ * hex-encoded, which stays safe even in an unquoted attribute — the case that
+ * breaks naive escaping, since a bare space or backtick can end the value and
+ * start a new attribute such as `onerror=`.
+ */
+declare function escapeAttribute(input: unknown): string;
+/**
+ * Escape and validate a value used as a URL.
+ *
+ * Returns '' when the protocol is not in `allowedProtocols`, which is what
+ * stops `javascript:`, `data:` and friends from reaching an `href`. Relative
+ * URLs are allowed through, since they cannot carry a protocol.
+ */
+declare function escapeUrl(input: unknown, options?: PurifaiOptions): string;
 /**
  * 🛡️ Purifai - Ultra-Secure HTML Sanitizer
  *
  * Advanced lightweight HTML sanitizer with superior XSS protection
  * against known attack vectors including advanced polyglot attacks.
+ *
+ * Every method delegates to a module-level function and reads no instance or
+ * class state, so `Purifai.sanitize` and the standalone `sanitize` export are
+ * interchangeable and neither depends on its call-site receiver.
  */
-declare class Purifai {
-    private static defaultOptions;
+export declare class Purifai {
     /**
      * Sanitize input with maximum security protection
      *
@@ -73,18 +116,6 @@ declare class Purifai {
      * ```
      */
     static analyze(input: unknown, options?: PurifaiOptions): PurifaiResult;
-    /**
-     * Decode common encoding bypasses
-     */
-    private static decodeEncodingBypasses;
-    /**
-     * Enhanced polyglot attack handling - Addresses sophisticated XSS techniques
-     */
-    private static handlePolyglotAttacks;
-    /**
-     * Assess threat level of input content
-     */
-    private static assessThreatLevel;
     /**
      * Check if input contains dangerous patterns
      *
@@ -115,6 +146,34 @@ declare class Purifai {
      * ```
      */
     static sanitizeBatch(inputs: unknown[], options?: PurifaiOptions): string[];
+    /**
+     * Escape text for an HTML body context (lossless — nothing is removed)
+     *
+     * @example
+     * ```typescript
+     * Purifai.escape('if (a<b && c>d)'); // "if (a&lt;b &amp;&amp; c&gt;d)"
+     * ```
+     */
+    static escape(input: unknown): string;
+    /**
+     * Escape text for an HTML attribute value, safe even when unquoted
+     *
+     * @example
+     * ```typescript
+     * `<div title="${Purifai.escapeAttribute(userInput)}">`
+     * ```
+     */
+    static escapeAttribute(input: unknown): string;
+    /**
+     * Escape a URL, returning '' if its protocol is not allowed
+     *
+     * @example
+     * ```typescript
+     * Purifai.escapeUrl('javascript:alert(1)'); // ""
+     * Purifai.escapeUrl('https://example.com'); // escaped, safe for href
+     * ```
+     */
+    static escapeUrl(input: unknown, options?: PurifaiOptions): string;
     /**
      * Get version information
      */
@@ -128,9 +187,5 @@ declare class Purifai {
         performance: string;
     };
 }
-declare const sanitize: typeof Purifai.sanitize;
-declare const analyze: typeof Purifai.analyze;
-declare const isDangerous: typeof Purifai.isDangerous;
-declare const sanitizeBatch: typeof Purifai.sanitizeBatch;
-
-export { Purifai, type PurifaiOptions, type PurifaiResult, analyze, Purifai as default, isDangerous, sanitize, sanitizeBatch };
+export { sanitize, analyze, isDangerous, sanitizeBatch, escape, escapeAttribute, escapeUrl };
+export default Purifai;