/**
 * Opt-in Tier-B escape-hatch fetchers: a self-hosted challenge-solver service
 * and a third-party hosted reader service. Both are OFF unless their URL is
 * configured — a default install never reaches this module (the router only
 * `import()`s it lazily when a rung is configured, so the idle footprint holds).
 *
 * Security posture (a reviewer audits this file):
 *   - Every network endpoint (sidecar URL + target URL + every redirect hop) is
 *     SSRF-guarded. The sidecar may be on loopback (self-hosted is the common
 *     case); the target honours the fetch allow-private policy. Cloud-metadata
 *     IPs (169.254/16) are blocked in ALL modes.
 *   - Redirects are followed MANUALLY with a per-hop re-guard + hop cap, and a
 *     Cookie header is dropped on any cross-host hop (mirrors the TLS tier).
 *   - The solver service's output is UNTRUSTED: any cookies it returns are NOT
 *     surfaced as reusable clearance and are never injected cross-domain.
 *   - The hosted reader EGRESSES the target URL off-machine; the target URL is
 *     redacted in logs.
 */
import type { RawFetchResult } from '../types.js';
/** The subset of Config the escape-hatch rungs need. */
export interface EscapeHatchConfig {
    solverUrl: string | null;
    hostedReaderUrl: string | null;
    fetchAllowPrivate: boolean;
    maxRedirects: number;
    fetchTimeoutMs: number;
}
type FetchImpl = (url: string, init: RequestInit) => Promise<Response>;
export interface EscapeHatchOpts {
    /** Injectable fetch (tests). Defaults to the global fetch. */
    fetchImpl?: FetchImpl;
    signal?: AbortSignal;
}
/**
 * Follow redirects manually from `startUrl`, re-guarding every hop under the
 * fetch SSRF policy and dropping the Cookie header on a cross-host hop. Returns
 * the terminal (non-3xx) Response, or null when a hop is blocked / the hop cap
 * is exceeded / the request errors.
 */
export declare function _guardedFollow(startUrl: string, init: RequestInit, cfg: EscapeHatchConfig, fetchImpl: FetchImpl): Promise<Response | null>;
/**
 * Send the target URL to a self-hosted challenge-solver service and return its
 * cleared HTML. Returns null when unconfigured, when a guard blocks the target
 * or the solver endpoint, or when the solver fails. Enabling a solver trusts it
 * as a content source; its returned cookies are intentionally discarded.
 */
export declare function solverFetch(targetUrl: string, cfg: EscapeHatchConfig, opts?: EscapeHatchOpts): Promise<RawFetchResult | null>;
/**
 * Send the target URL to a third-party hosted reader service and return its
 * rendered content. Returns null when unconfigured or when a guard blocks a
 * hop. This EGRESSES the target URL off-machine — the target is redacted in
 * logs.
 */
export declare function hostedReaderFetch(targetUrl: string, cfg: EscapeHatchConfig, opts?: EscapeHatchOpts): Promise<RawFetchResult | null>;
export {};
//# sourceMappingURL=escape-hatch.d.ts.map