import { type JSONSchema } from "./json-schema.js";
/**
 * Which URLs a prop declared as a URL (`z.url()`) may hold. An object changes the default rules field by field; a
 * predicate replaces them.
 *
 * @example
 * const urlPolicy: UrlPolicy = { hosts: ["cdn.example.com", "*.imgix.net"] };
 *
 * @example
 * const urlPolicy: UrlPolicy = (url) => url.startsWith("https://cdn.example.com/");
 */
export type UrlPolicy = {
    /** Relative URLs: `/a`, `a/b`, `?q=1`, `#x`. Default `true`. */
    allowRelative?: boolean;
    /** Absolute URLs on the page origin. Default `true`. */
    allowSameOrigin?: boolean;
    /** Extra http/https hosts: an exact match, or `*.example.com` for subdomains (not the apex, so list both). */
    hosts?: readonly string[];
    /** `data:` raster images. Default `true`. SVG is never allowed: it can carry script. */
    allowDataImages?: boolean;
    /** The page origin, for where there is no `location` (SSR); without either, only `hosts` matches an absolute URL. */
    origin?: string;
} | ((url: string) => boolean);
type UrlCheck = {
    ok: true;
} | {
    ok: false;
    reason: string;
};
export declare const resolveUrlPolicy: (policy?: Exclude<UrlPolicy, (url: string) => boolean>) => {
    allowRelative: boolean;
    allowSameOrigin: boolean;
    hosts: readonly string[];
    allowDataImages: boolean;
    origin: string | undefined;
};
export declare const checkUrl: (value: string, policy?: UrlPolicy) => UrlCheck;
type UrlViolation = {
    path: string;
    url: string;
    reason: string;
};
export declare const findUrlViolations: (schema: JSONSchema | undefined, value: unknown, policy?: UrlPolicy) => UrlViolation[];
export declare const schemaHasUrlFormat: (schema: JSONSchema | undefined) => boolean;
export {};