export declare function assertBrowserUrlAllowed(rawUrl: string, opts: {
    allowPrivateHosts?: boolean | undefined;
    allowedPrivateOrigins?: readonly string[] | undefined;
    navigation?: boolean | undefined;
}): Promise<URL>;
export interface BrowserResolvedTarget {
    url: URL;
    address: string;
    family: 4 | 6;
}
export type BrowserDnsLookup = (hostname: string) => Promise<readonly {
    address: string;
    family: number;
}[]>;
/**
 * Resolve once, validate every answer, and return the exact address a socket
 * must use. Callers must connect to `address`, never resolve `url.hostname`
 * again, otherwise DNS rebinding remains possible.
 */
export declare function resolvePinnedBrowserTarget(rawUrl: string, opts?: {
    allowPrivateHosts?: boolean | undefined;
    allowedPrivateOrigins?: readonly string[] | undefined;
    lookup?: BrowserDnsLookup | undefined;
}): Promise<BrowserResolvedTarget>;
export declare function parsePrivateOriginAllowlist(raw: string | undefined): string[];
/** Remove credentials, query strings, and fragments before persistence/output. */
export declare function safeBrowserUrl(rawUrl: string): string;
export declare function redactBrowserText(text: string): string;
//# sourceMappingURL=security.d.ts.map