/**
 * sourceReader — reads source text from a file:// or http(s):// URI.
 *
 * Used by the bridge tools when the caller provides source_uri instead of
 * passing the full text as a tool argument. Reading source directly means
 * the raw content never traverses the frontier LLM's context window, which
 * is the only regime where the bridge actually saves frontier tokens.
 *
 * Security:
 *   - file:// reads are unrestricted (bridge runs with the user's own
 *     filesystem access; the host app's trust boundary covers this).
 *   - http(s):// reads enforce a size cap, a timeout, a content-type
 *     allowlist, and an optional SSRF denylist for private IP ranges.
 *
 * Environment variables:
 *   OMCP_URL_MAX_BYTES   — max response body (default 10 485 760 = 10 MB)
 *   OMCP_URL_TIMEOUT_MS  — fetch timeout in ms (default 30 000)
 *   OMCP_URL_DENY_PRIVATE — '0' to disable private-IP block (default on)
 *   OMCP_URL_HOSTS       — comma-separated allowlist of hostnames; if set,
 *                          only requests to matching hosts are allowed
 */
export interface ReadSourceOptions {
    /** Maximum bytes to read from an http(s) response. Default 10 MB. */
    maxBytes: number;
    /** Fetch timeout in milliseconds. Default 30 000. */
    timeoutMs: number;
    /** Deny requests to private/loopback hosts. Default true. */
    denyPrivate: boolean;
    /** If set, only requests whose hostname matches an entry are allowed. */
    allowedHosts?: string[];
}
export interface SourceReadResult {
    /** Decoded UTF-8 text content. */
    text: string;
    /** Raw byte size of the content (before text decoding). */
    bytes: number;
    /** MIME content-type as reported by the source (or 'text/plain' for files). */
    contentType: string;
}
/** Build ReadSourceOptions from environment variables with documented defaults. */
export declare function readSourceOptionsFromEnv(): ReadSourceOptions;
/**
 * Throw if `hostname` is disallowed by the SSRF policy: allowlist takes
 * priority (only matching hosts pass); otherwise the private-IP denylist
 * applies. Shared by `readSource` (text) and `readImageSource` (image) so the
 * two paths can never drift on this security check.
 */
export declare function assertHostAllowed(hostname: string, opts: ReadSourceOptions): void;
/**
 * Fetch with the SSRF host policy enforced on EVERY hop, plus the request
 * timeout. `redirect: 'manual'` so a 3xx can't transparently bounce the request
 * to a private/internal host behind a public hostname — each Location is
 * re-validated by `assertHostAllowed` before it is followed. Returns the final
 * (non-redirect) Response; the caller checks `res.ok`.
 */
export declare function safeFetch(initialUrl: string, opts: ReadSourceOptions, init?: {
    headers?: Record<string, string>;
}, maxRedirects?: number): Promise<Response>;
/**
 * Read a fetch Response body into a Buffer with a hard byte cap: rejects via the
 * Content-Length preflight when present, and STREAMS otherwise — cancelling at
 * the cap so a body with no/lying Content-Length can't exhaust memory. Shared by
 * the text and image readers so neither path can regress to an unbounded buffer.
 */
export declare function readCappedBody(res: Response, maxBytes: number): Promise<Buffer>;
/**
 * Read text from a URI. Supports file://, http://, https://.
 * Throws a descriptive Error on any failure (scheme unsupported, SSRF blocked,
 * size exceeded, timeout, non-2xx HTTP, disallowed content-type, etc.).
 * The caller should surface the error message to the user as isError: true.
 */
export declare function readSource(uri: string, opts: ReadSourceOptions): Promise<SourceReadResult>;
//# sourceMappingURL=sourceReader.d.ts.map