/** Target-URL guard for the one-shot REST endpoints. Isomorphic: literal-address
 *  checks only, no DNS. The Node server layer adds resolution on top. */
/** True when the literal address is loopback, link-local, or in a private range. */
export declare function isPrivateAddress(host: string): boolean;
export interface TargetUrlPolicy {
    /** Hostnames exempt from the private-address block (exact match, lowercase). */
    allowedPrivateHosts?: readonly string[];
}
export interface TargetUrlVerdict {
    ok: boolean;
    reason?: string;
    hostname?: string;
}
/**
 * Validates a user-supplied navigation target. Allows `http:` and `https:` only,
 * and refuses hosts that are loopback, link-local, or in a private range unless
 * the policy names them.
 */
export declare function checkTargetUrl(url: string, policy?: TargetUrlPolicy): TargetUrlVerdict;
/** True when the policy explicitly permits this hostname to be private. */
export declare function isHostExempt(hostname: string, policy: TargetUrlPolicy): boolean;
//# sourceMappingURL=target-url.d.ts.map