import { lookup } from 'node:dns/promises';
import type { SsrfPolicy } from './types.js';
export type LookupFn = typeof lookup;
/**
 * Thrown when a navigation URL is blocked by SSRF policy.
 * Callers can catch this specifically to distinguish navigation blocks
 * from other errors.
 */
export declare class InvalidBrowserNavigationUrlError extends Error {
    constructor(message: string);
}
/** Options for browser navigation SSRF policy. */
export type BrowserNavigationPolicyOptions = {
    ssrfPolicy?: SsrfPolicy;
};
/** Build a BrowserNavigationPolicyOptions from an SsrfPolicy. */
export declare function withBrowserNavigationPolicy(ssrfPolicy?: SsrfPolicy): BrowserNavigationPolicyOptions;
/**
 * Assert that a URL is allowed for browser navigation under the given SSRF policy.
 * Throws `InvalidBrowserNavigationUrlError` if the URL is blocked.
 */
export declare function assertBrowserNavigationAllowed(opts: {
    url: string;
    lookupFn?: LookupFn;
} & BrowserNavigationPolicyOptions): Promise<void>;
/**
 * Validate that an output file path is safe — no directory traversal or escape.
 * Rejects paths containing `..` segments or relative paths that could escape
 * the intended output directory.
 *
 * @param path - The output path to validate
 * @param allowedRoots - Optional list of allowed root directories. If provided,
 *   the resolved path must be within one of these roots.
 * @throws If the path is unsafe
 */
export declare function assertSafeOutputPath(path: string, allowedRoots?: string[]): Promise<void>;
/**
 * Check whether a URL targets a loopback or private/internal network address.
 * Synchronous hostname-based check. Used to prevent SSRF attacks.
 */
export declare function isInternalUrl(url: string): boolean;
/**
 * Validate upload file paths immediately before use — rejects symlinks,
 * missing files, and non-regular files to prevent TOCTOU path-swap attacks.
 */
export declare function assertSafeUploadPaths(paths: string[]): Promise<void>;
/**
 * Async version that also resolves DNS to catch rebinding attacks
 * where a public hostname resolves to an internal IP.
 */
export declare function isInternalUrlResolved(url: string, lookupFn?: LookupFn): Promise<boolean>;