import { Router } from 'express';
declare const router: Router;
interface ParsedHostport {
    host: string;
    port: number;
}
export declare function parseHostport(raw: string): ParsedHostport | null;
/**
 * Allowlist check on a literal IPv4/IPv6 address. Unlike notify-service's
 * isPrivateAddress (which is a deny-list for outbound webhooks and uses
 * loose startsWith on the *hostname*), this is strictly numeric and refuses
 * the cloud-metadata link-local addresses even though they're RFC1918.
 */
export declare function isAllowedProxyIp(addr: string): boolean;
/**
 * Resolve hostname to a single IP (or accept literal IP) and confirm it's
 * in the allowed private range. Returns the resolved IP to pin against
 * DNS-rebinding TOCTOU: callers fetch by IP, not by hostname.
 */
export declare function resolveAllowedTarget(host: string): Promise<string | null>;
/**
 * Rewrite root-relative absolute paths (src/href/action="/...") through
 * this proxy. Also strip any upstream `<base href="...">` so the original
 * declaration cannot redirect relative resolution back out to the bare
 * ccweb origin. Protocol-relative and relative paths are untouched —
 * browser resolves them against the iframe URL which is already proxied.
 */
export declare function rewriteHtml(html: string, prefix: string): string;
export declare function rewriteLocationHeader(loc: string, parsed: ParsedHostport, mountPrefix: string): string;
export default router;
//# sourceMappingURL=browser-proxy.d.ts.map