export declare function isAllowedRemoteHost(url: URL, allowedHosts: string[]): boolean;
export type ModuleSpecifierScan = {
    specifiers: string[];
    hasUnconstrainedDynamicImport: boolean;
    /** Slash syntax needs a real parser before the source can execute directly. */
    requiresBundling: boolean;
    /** Dynamic code generation can synthesize imports after static validation. */
    hasDynamicCodeGeneration: boolean;
};
export declare function scanModuleSpecifiers(source: string): ModuleSpecifierScan;
/**
 * Every string-literal specifier a module's static text can name: static
 * imports, `export ... from`, side-effect imports, and dynamic `import()`
 * calls whose argument is a literal.
 */
export declare function extractModuleSpecifiers(source: string): string[];
export declare function validateModuleSpecifierHosts(specifiers: string[], allowedHosts: string[]): void;
/**
 * Why importing `specifier` cannot be checked against the allow-list, or null
 * when the module is not restricted. URL schemes are case-insensitive, so the
 * comparison is too.
 */
export declare function restrictedRuntimeModuleReason(specifier: string): string | null;
/**
 * The module specifiers of every local worker this source starts, and null for
 * a local worker whose base this scanner does not follow. Callers that need to
 * distinguish module-relative URLs from route-relative string Workers must use
 * the structured entries returned by `validateHTTPImports`.
 *
 * A worker entry is executed by the worker's own loader, which the HTTP plugin
 * never sees, so a caller that vets a module graph must vet these entries too.
 */
export declare function collectLocalWorkerSpecifiers(source: string): Promise<Array<string | null>>;
/**
 * Refuse a worker whose module cannot be checked against the allow-list.
 * A remote, inline, or file worker URL is rejected outright — even an allow-listed
 * origin, since the worker loader bypasses the HTTP plugin and bundling cannot
 * help — and a non-literal worker URL fails closed.
 */
export declare function validateModuleWorkers(source: string): Promise<void>;
export interface ValidatedModuleScan {
    readonly specifiers: readonly string[];
    readonly hasUnconstrainedDynamicImport: boolean;
    readonly requiresBundling: boolean;
    readonly parserBacked: boolean;
    readonly localWorkerSpecifiers: readonly LocalWorkerSpecifier[];
}
export interface LocalWorkerSpecifier {
    readonly specifier: string;
    readonly resolutionBase: "module" | "route";
}
export declare function validateHTTPImports(source: string, allowedHosts: string[]): Promise<ValidatedModuleScan>;
//# sourceMappingURL=http-validator.d.ts.map