/**
 * @module @arcis/node/validation/redirect
 * Open Redirect prevention
 *
 * Prevents attackers from using your app to redirect users to malicious sites
 * via manipulated query parameters like ?returnUrl=http://evil.com
 *
 * @example
 * import { validateRedirect, isRedirectSafe } from '@arcis/node';
 *
 * // Block open redirects
 * validateRedirect('http://evil.com')                    // { safe: false, reason: 'absolute URL not in allowed hosts' }
 * validateRedirect('//evil.com')                         // { safe: false, reason: 'protocol-relative URL not in allowed hosts' }
 * validateRedirect('javascript:alert(1)')                // { safe: false, reason: 'dangerous protocol: javascript:' }
 *
 * // Allow safe redirects
 * validateRedirect('/dashboard')                         // { safe: true }
 * validateRedirect('/users?page=2')                      // { safe: true }
 * validateRedirect('https://myapp.com/home', { allowedHosts: ['myapp.com'] })  // { safe: true }
 */
/** Options for redirect validation */
export interface ValidateRedirectOptions {
    /** Hostnames that are allowed for absolute URL redirects */
    allowedHosts?: string[];
    /** Allow protocol-relative URLs (//example.com). Default: false */
    allowProtocolRelative?: boolean;
    /** Allowed protocols for absolute URLs. Default: ['http:', 'https:'] */
    allowedProtocols?: string[];
}
/** Result of redirect validation */
export interface ValidateRedirectResult {
    /** Whether the redirect URL is safe */
    safe: boolean;
    /** Reason the redirect was blocked (only set when safe=false) */
    reason?: string;
}
/**
 * Validate a redirect URL to prevent open redirect attacks.
 *
 * Safe redirects:
 * - Relative paths: /dashboard, /users?page=2, ../settings
 * - Absolute URLs to allowed hosts (when configured)
 *
 * Blocked redirects:
 * - Absolute URLs to unknown hosts
 * - Protocol-relative URLs (//evil.com)
 * - javascript:, data:, vbscript:, blob: protocols
 * - Backslash-prefixed paths (\\evil.com — browser treats as //)
 * - URLs with control characters that could disguise the target
 *
 * @param url - The redirect target URL to validate
 * @param options - Validation options
 * @returns Validation result with safe flag and optional reason
 */
export declare function validateRedirect(url: string, options?: ValidateRedirectOptions): ValidateRedirectResult;
/**
 * Convenience wrapper that returns true/false.
 *
 * @param url - The redirect URL to check
 * @param options - Validation options
 * @returns true if the redirect is safe
 */
export declare function isRedirectSafe(url: string, options?: ValidateRedirectOptions): boolean;
//# sourceMappingURL=redirect.d.ts.map