export type ValidationResult = {
    ok: true;
    url: URL;
} | {
    ok: false;
    reason: string;
};
export declare function validateSourceUrl(raw: string): ValidationResult;
/**
 * Resolve a hostname to its A/AAAA records. Pulled out as an injectable type
 * so tests can stub DNS without hitting the network. The real resolver uses
 * Node's `dns.promises`.
 */
export type Resolver = (host: string) => Promise<string[]>;
export declare const defaultResolver: Resolver;
/**
 * Same as `assertSafeSourceUrl`, but ALSO resolves the hostname and checks
 * every returned IP against the IPv4/IPv6 blocklists. Prevents DNS-rebinding
 * attacks where a public hostname resolves to a private IP (round-5 F-001).
 *
 * Returns BOTH the URL and the validated IPs so callers can pin the fetch
 * to one of those IPs without resolving again (round-8 F-001/F-002).
 * Performing a second DNS lookup at fetch time would re-open the TOCTOU
 * window the validator was supposed to close.
 *
 * For raw IP literals, `ips` contains the literal itself (no DNS lookup).
 */
export interface DnsValidatedUrl {
    url: URL;
    ips: string[];
}
export declare function assertSafeSourceUrlWithDns(raw: string, resolver?: Resolver): Promise<DnsValidatedUrl>;
/**
 * Throws if the URL would route to a restricted target. Use at every external
 * fetch boundary; the helper is intentionally identical for prefilter, apply,
 * and meta-prompt dispatch so one guard covers all three callsites.
 */
export declare function assertSafeSourceUrl(raw: string): URL;
/**
 * Load the allowlist from `docs/knowledge-freshness/authoritative-sources.yaml`
 * (relative to `projectRoot`). Used by the operations / CI gate to flag
 * out-of-list sources as warnings (not hard blocks per resolved decision #4).
 * Returns an empty Set when the file is missing so the caller treats every
 * host as out-of-list and warns — the safer default than "silently allow".
 */
interface Allowlist {
    hosts: string[];
    github_repos: string[];
}
export declare function loadAuthoritativeAllowlist(projectRoot: string): Allowlist;
/**
 * Returns true if `url`'s host (or github repo path) appears in the allowlist.
 * Decision #4 (locked): off-allowlist sources warn, not block.
 */
export declare function isAllowlistedSource(url: URL, allowlist: Allowlist): boolean;
export {};
//# sourceMappingURL=source-url-validator.d.ts.map