export type ResolvedAddress = {
    address: string;
    family?: number;
};
export type ResolveHostname = (hostname: string) => Promise<ResolvedAddress[]>;
export interface SafeRemoteUrlOptions {
    /** Skip the private-network checks (trusted callers only, e.g. local dev). */
    allowPrivateNetworkHosts?: boolean;
    /** Injectable resolver for tests; defaults to {@link defaultResolveHostname}. */
    resolveHostname?: ResolveHostname;
}
export declare function defaultResolveHostname(hostname: string): Promise<ResolvedAddress[]>;
export declare function isBlockedIPv4(address: string): boolean;
export declare function isBlockedIPv6(address: string): boolean;
export declare function isBlockedAddress(address: string): boolean;
/**
 * Parse and validate a remote URL for outbound fetching. Rejects non-http(s)
 * schemes, embedded credentials, and hosts that resolve to non-public ranges.
 * Returns the parsed {@link URL} on success; throws a descriptive `Error`
 * otherwise.
 */
export declare function assertSafeRemoteUrl(rawUrl: string, options?: SafeRemoteUrlOptions): Promise<URL>;
export interface SafeRedirectOptions extends SafeRemoteUrlOptions {
    /** Maximum redirect hops to follow before failing. Default 5. */
    maxRedirects?: number;
    /** Per-hop timeout in ms. Default 10s. */
    timeoutMs?: number;
    /** Injectable fetch (primarily for tests). Defaults to global `fetch`. */
    fetchImpl?: typeof fetch;
}
/**
 * Resolve a URL's redirect chain and return the final safe {@link URL}, with
 * EVERY hop re-validated through {@link assertSafeRemoteUrl}.
 *
 * Use this before handing a URL to a fetcher that follows redirects on its own
 * (e.g. `fetchDocument`): the up-front {@link assertSafeRemoteUrl} check alone
 * can't stop an allowed public host from `30x`-redirecting into an internal /
 * loopback / metadata host, which would defeat the SSRF guard (review #1562).
 *
 * Redirects are followed with `GET` + `redirect: 'manual'` to match downstream
 * GET-based fetchers; response bodies are discarded (the redirect bodies are
 * empty and the terminal body is left for the caller to re-fetch), so this does
 * not double-download content.
 */
export declare function resolveSafeFinalUrl(rawUrl: string, options?: SafeRedirectOptions): Promise<URL>;
/**
 * Strip userinfo (`user:pass@`) from a URL so it can be safely logged or echoed
 * in an error message. Returns a placeholder for unparseable input. Never let a
 * credential-bearing URL reach logs/errors verbatim (review #1562).
 */
export declare function redactUrlCredentials(raw: string): string;
//# sourceMappingURL=safe-remote-url.d.ts.map