import type { IncomingHttpHeaders } from "node:http";
import { request } from "node:https";
import { type LookupFunction } from "node:net";
/**
 * Describes resolved hostname address data exchanged by the lifecycle pipeline.
 */
export interface ResolvedHostnameAddress {
    address: string;
    family: 4 | 6;
}
/**
 * Defines the supported hostname resolver values.
 */
export type HostnameResolver = (hostname: string) => Promise<ResolvedHostnameAddress[]>;
/**
 * Defines the supported guarded request body values.
 */
export type GuardedRequestBody = string | Buffer | URLSearchParams | ArrayBuffer | ArrayBufferView | null | undefined;
/**
 * Describes fetch with guards options data exchanged by the lifecycle pipeline.
 */
export interface FetchWithGuardsOptions {
    allowedOrigins?: readonly string[];
    body?: GuardedRequestBody;
    headers?: HeadersInit;
    maxBytes?: number;
    method?: string;
    resolveHostname?: HostnameResolver;
    signal?: AbortSignal;
    /** When true, expose non-2xx responses as errors with a numeric status. */
    throwOnHttpError?: boolean;
    timeoutMs?: number;
}
type HttpsRequest = typeof request;
declare function setHttpsRequestForTests(nextRequest: HttpsRequest): () => void;
/** Enables the guarded-fetch mock path for controlled tests only. */
declare function setTestFetchMocksForTests(enabled: boolean): () => void;
/**
 * Performs an HTTP(S) fetch with a timeout. Origin allowlists are enforced by
 * the higher-level guarded fetch helpers.
 */
export declare function fetchWithTimeout(url: string, options?: RequestInit, timeoutMs?: number): Promise<Response>;
/**
 * Fetches text from an explicitly allowed origin without buffering more than
 * the configured byte limit into memory.
 */
export declare function fetchTextWithGuards(url: string, options?: FetchWithGuardsOptions): Promise<string | null>;
/**
 * Fetches bytes with guards with the configured runtime safeguards.
 */
export declare function fetchBytesWithGuards(url: string, options?: FetchWithGuardsOptions): Promise<Buffer | null>;
/**
 * Fetches JSON with the same URL and response-size guards as text fetches.
 *
 * The fetch layer decodes response bytes with the WHATWG TextDecoder, which
 * STRIPS a leading UTF-8 BOM before any text reaches this function — so a
 * BOM never lands in `text` here (a BOM'd feed used to fail JSON.parse and
 * silently sync nothing only while the decoder kept it; the decoder does
 * not). Duplicate keys keep JSON.parse's standard last-wins semantics —
 * pinned by tests so the behavior stays deliberate.
 */
export declare function fetchJsonWithGuards(url: string, options?: FetchWithGuardsOptions): Promise<unknown | null>;
/**
 * Validates that a URL is HTTPS and belongs to one of the provided origins.
 */
export declare function assertAllowedPublicHttpUrl(url: string, allowedOrigins: readonly string[]): URL;
/**
 * Validates unknown data as allowed public http url with dns.
 */
export declare function assertAllowedPublicHttpUrlWithDns(url: string, allowedOrigins: readonly string[], resolveHostname?: HostnameResolver): Promise<URL>;
/**
 * Validates unknown data as allowed http url.
 */
export declare function assertAllowedHttpUrl(url: string, allowedOrigins: readonly string[]): URL;
/**
 * Validates unknown data as public internet hostname.
 */
export declare function assertPublicInternetHostname(parsedUrl: URL): void;
/**
 * Validates unknown data as public internet resolution.
 */
export declare function assertPublicInternetResolution(parsedUrl: URL, resolveHostname?: HostnameResolver): Promise<void>;
declare function fetchWithPinnedResolution(parsedUrl: URL, addresses: readonly ResolvedHostnameAddress[], options: FetchWithGuardsOptions, timeoutMs: number): Promise<Response>;
declare function requestWithPinnedAddress(parsedUrl: URL, address: ResolvedHostnameAddress, options: FetchWithGuardsOptions, signal: AbortSignal): Promise<Response>;
/**
 * Builds a DNS lookup override pinned to a single resolved address while
 * honoring Node's single-result and all-results lookup callback modes.
 */
export declare function createPinnedLookup(address: ResolvedHostnameAddress): LookupFunction;
declare function serializeRequestBody(body: GuardedRequestBody): string | Buffer | null;
declare function buildHttpStatusError(response: Response): Error & {
    status: number;
};
declare function buildResponseHeaders(headers: IncomingHttpHeaders): Headers;
declare function normalizeResolvedHostnameAddresses(addresses: readonly {
    address: string;
    family: number;
}[]): ResolvedHostnameAddress[];
declare function isPrivateIpv4Address(hostname: string): boolean;
declare function isPrivateIpv6Address(hostname: string): boolean;
/**
 * Reads a response body while enforcing a maximum byte count before decoding.
 */
export declare function readResponseTextWithLimit(response: Response, maxBytes: number, timeoutMs?: number): Promise<string>;
/**
 * Reads response bytes with limit from project state.
 */
export declare function readResponseBytesWithLimit(response: Response, maxBytes: number, timeoutMs?: number): Promise<Buffer>;
declare function withBodyReadTimeout<T>(operation: Promise<T>, timeoutMs: number, cleanup?: () => Promise<void> | void): Promise<T>;
/**
 * Exposes narrow HTTP internals for focused behavioral coverage.
 */
export declare const httpInternals: {
    fetchWithPinnedResolution: typeof fetchWithPinnedResolution;
    requestWithPinnedAddress: typeof requestWithPinnedAddress;
    buildHttpStatusError: typeof buildHttpStatusError;
    serializeRequestBody: typeof serializeRequestBody;
    buildResponseHeaders: typeof buildResponseHeaders;
    isPrivateIpv4Address: typeof isPrivateIpv4Address;
    isPrivateIpv6Address: typeof isPrivateIpv6Address;
    withBodyReadTimeout: typeof withBodyReadTimeout;
    setHttpsRequestForTests: typeof setHttpsRequestForTests;
    setTestFetchMocksForTests: typeof setTestFetchMocksForTests;
    normalizeResolvedHostnameAddresses: typeof normalizeResolvedHostnameAddresses;
};
export {};