export interface UrlSafetyResult {
    safe: boolean;
    reason?: string;
}
/**
 * Check whether a URL is safe to fetch (not targeting private/internal addresses).
 *
 * Blocks:
 * - Cloud metadata endpoints (always, non-negotiable)
 * - Private/loopback/link-local IP addresses
 * - localhost and internal hostnames
 * - URLs with embedded credentials
 * - Non-HTTP(S) schemes
 *
 * Returns `{ safe: true }` for allowed URLs,
 * or `{ safe: false, reason }` for blocked ones.
 */
export declare function checkUrlSafety(rawUrl: string): UrlSafetyResult;
/**
 * Assert that a URL is safe to fetch. Throws on blocked URLs.
 * Convenience wrapper over {@link checkUrlSafety}.
 */
export declare function assertUrlSafe(rawUrl: string): void;
export interface WebsiteBlocklistConfig {
    enabled?: boolean;
    /** Domain patterns to block (e.g. "example.com", "*.evil.org"). */
    domains?: string[];
}
/**
 * Check whether a URL is blocked by the website blocklist.
 *
 * Returns `undefined` if allowed, or a block descriptor if blocked.
 */
export declare function checkWebsiteBlocklist(rawUrl: string, blocklist?: WebsiteBlocklistConfig): {
    host: string;
    rule: string;
    message: string;
} | undefined;
/**
 * Remove base64-encoded images from text to reduce token usage.
 * Strips patterns like `data:image/png;base64,...` and their markdown wrappers.
 */
export declare function cleanBase64Images(text: string): string;