/** True for an inline `data:` font URI (no network — safe to decode directly). */
export declare function isDataFontUrl(path: string): boolean;
/**
 * True when a font path carries its own authority (`//host`, `http://host`,
 * `\\host`) or a non-http scheme — i.e. it would not resolve same-origin.
 *
 * Classification resolves the path against a sentinel origin through the WHATWG
 * URL parser, so it sees exactly what `fetch` will: leading C0 controls/spaces,
 * embedded tab/CR/LF, and backslash folding are all normalized first. This
 * closes the bypass class where " //127.0.0.1" or " //169.254.169.254" looks
 * relative to a naive scheme check yet resolves cross-origin (GHSA-q8hw-4fvp-9rwv).
 * Check `isDataFontUrl` first — `data:` is non-http and would report true here.
 */
export declare function isExternalFontUrl(path: string): boolean;
/**
 * Resolve an authority-bearing font URL to the href to fetch, but only when it
 * is same-origin with the configured site URL. Returns null otherwise.
 *
 * Runtime external font URLs are unsupported — `@nuxt/fonts` is the only
 * supported way to load custom fonts, and it serves them same-origin. The single
 * allowed exception is the site's own origin, gated on an explicitly configured
 * site URL. Resolving against that origin also collapses canonicalization
 * bypasses (a crafted " //127.0.0.1" resolves cross-origin → rejected).
 */
export declare function resolveSameOriginFontUrl(path: string, siteUrl: string | undefined): string | null;
/**
 * Fetch a `data:` or authority-bearing font URL. `data:` is decoded directly
 * (no network). An external URL is fetched only when same-origin with the site
 * URL, and always through the SSRF guard (scheme allowlist, private-network
 * block, per-hop redirect re-validation) so the site's own host can't be used
 * to relay into its internal network via an open redirect.
 *
 * Throws on an unsupported/blocked/unreachable URL so the caller falls back to a
 * bundled font; blocked targets stay indistinguishable from missing fonts.
 */
export declare function fetchSpecialFontUrl(path: string, siteUrl: string | undefined, timeout: number): Promise<Buffer>;