import { Router } from 'express';
declare const router: Router;
interface ParsedHostport {
    host: string;
    port: number;
}
export declare function parseHostport(raw: string): ParsedHostport | null;
/**
 * Allowlist check on a literal IPv4/IPv6 address. Unlike notify-service's
 * isPrivateAddress (which is a deny-list for outbound webhooks and uses
 * loose startsWith on the *hostname*), this is strictly numeric and refuses
 * the cloud-metadata link-local addresses even though they're RFC1918.
 */
export declare function isAllowedProxyIp(addr: string): boolean;
/**
 * Resolve hostname to a single IP (or accept literal IP) and confirm it's
 * in the allowed private range. Returns the resolved IP to pin against
 * DNS-rebinding TOCTOU: callers fetch by IP, not by hostname.
 */
export declare function resolveAllowedTarget(host: string): Promise<string | null>;
/**
 * Strip `_bp_tok=<jwt>` from a subPath string ("/foo/bar?x=1&_bp_tok=...&y=2#z")
 * so the upstream never sees the session token. Idempotent: missing token
 * is a no-op. Handles token in any query position and an empty resulting
 * query (leaves no orphan "?").
 */
export declare function stripTokenFromSubPath(subPath: string): string;
/**
 * Rewrite root-relative absolute paths (src/href/action="/...") through
 * this proxy. Also strip any upstream `<base href="...">` so the original
 * declaration cannot redirect relative resolution back out to the bare
 * ccweb origin. Each rewritten URL carries the session token so the iframe
 * can fetch it without relying on cookies that the sandbox would drop.
 * Protocol-relative and relative paths are untouched — relative URLs are
 * resolved by the browser against the iframe URL (which already has the
 * token in its query), and the browser preserves that query on the resolved
 * URL? No — relative resolution does NOT inherit query. So relative paths
 * within the page will appear without the token. They will fail. v0 limit.
 */
export declare function rewriteHtml(html: string, prefix: string, token: string): string;
export declare function rewriteLocationHeader(loc: string, parsed: ParsedHostport, mountPrefix: string, token: string): string;
export default router;
//# sourceMappingURL=browser-proxy.d.ts.map