import type { LookupAddress } from "node:dns";
export type WebDnsResolver = (hostname: string, options: {
    all: true;
    verbatim: true;
}) => Promise<LookupAddress[]>;
export interface AdministrativeNetworkPolicy {
    /** Host-owned test/administration policy. This value is never accepted from a model tool call. */
    allowPrivateNetwork: true;
    /** Explicit host allowlist; broad private-network access is never inferred. */
    allowedHosts: readonly string[];
}
export declare function isBlockedWebAddress(address: string): boolean;
export declare function validateWebUrlSyntax(value: string): URL;
export declare function resolveAndValidateWebUrl(value: string, options?: {
    resolver?: WebDnsResolver;
    administrativeNetworkPolicy?: AdministrativeNetworkPolicy;
    signal?: AbortSignal;
}): Promise<{
    url: URL;
    addresses: LookupAddress[];
}>;
//# sourceMappingURL=security.d.ts.map