export interface ValidateOptions {
    /**
     * When true, allow loopback / RFC-1918 / link-local hosts. Defaults
     * to false. Set to true in dev or for merchants whose engine lives
     * on a private network.
     */
    allowPrivate?: boolean;
}
export declare class UrlValidationError extends Error {
    constructor(message: string);
}
/**
 * Validates that the configured engine URL:
 *
 *  - Parses as a URL
 *  - Uses `http:` or `https:` (no `file:` / `javascript:` / `gopher:`)
 *  - Does NOT resolve to a loopback / private / link-local literal,
 *    unless the caller explicitly passes `allowPrivate: true`
 *
 * DNS-level rebinding is out of scope (the engine URL is set by the
 * merchant in their own process and not user-supplied). We're
 * defending against operator mistakes — e.g. wiring a public-internet
 * base URL that points back inside the cluster — rather than a
 * malicious admin.
 */
export declare function validateEngineUrl(rawUrl: string, options?: ValidateOptions): URL;
/**
 * Strip trailing forward slashes from a URL string.
 *
 * Imperative version of `s.replace(/\/+$/, '')` — avoids a regex with
 * a `+` quantifier so static analyzers stop flagging it as a potential
 * ReDoS vector.
 */
export declare function stripTrailingSlashes(s: string): string;
//# sourceMappingURL=url.d.ts.map