import type { MarkdownUrlPolicy } from './types.js';
/**
 * URL policy enforcement (decision A4 — strict by default).
 *
 * LLM output is untrusted input: prompt-injected markdown links/images are a
 * proven data-exfiltration channel (query-param payloads to attacker hosts)
 * even without any script execution. Policy therefore runs on every URL the
 * parser emits, and blocked URLs never reach the produced node tree — a
 * blocked link/image carries `blocked: true` and an empty href/src.
 *
 * Checks run against the *normalized* absolute URL (WHATWG `URL`), so scheme
 * tricks (`JaVaScRiPt:`, embedded tabs/newlines, `https:\\host`, `/../`
 * path escapes against a prefix) are neutralized before matching.
 */
export declare const DEFAULT_LINK_PROTOCOLS: string[];
export type UrlCheck = {
    ok: true;
    href: string;
} | {
    ok: false;
};
/**
 * Check a link destination. Relative references are always allowed; absolute
 * URLs must carry an allowed protocol.
 */
export declare function checkLinkUrl(raw: string, policy: MarkdownUrlPolicy | undefined): UrlCheck;
/**
 * Check an image source. Relative references are allowed (same-origin is not
 * an exfiltration sink); absolute URLs must match an allowlisted prefix on
 * the normalized href. The default empty allowlist blocks every external
 * image — the CamoLeak lesson, and the posture ChatGPT/Copilot converged on.
 */
export declare function checkImageUrl(raw: string, policy: MarkdownUrlPolicy | undefined): UrlCheck;