/**
 * Validate that a webhook URL does not target private/internal networks
 * (string-level SSRF prevention).
 *
 * Catches every IP-literal encoding `getaddrinfo` accepts: decimal
 * (`http://2130706433`), octal (`http://0177.0.0.1`), hex
 * (`http://0x7f.0.0.1`), short-form (`http://127.1`), IPv4-mapped IPv6
 * (`http://[::ffff:127.0.0.1]`), bracketed IPv6, and the reserved
 * `100.64.0.0/10` carrier-grade NAT range that previously slipped through.
 *
 * **Important caveat:** this only validates the URL **as written**. A hostname
 * like `attacker-controlled.tld` that resolves to a public IP at validation
 * time and to `127.0.0.1` at fetch time (DNS rebinding) still bypasses this
 * check — `safeFetch` calls `resolveAndCheck()` on top to defend against that.
 */
export declare function validateWebhookUrl(url: string): {
    valid: boolean;
    error?: string;
};
/**
 * Resolve a hostname's A/AAAA records and verify none of them land in a
 * private range. Pair with `validateWebhookUrl` to defend against DNS
 * rebinding — see `safeFetch`.
 */
export declare function resolveAndCheck(hostname: string): Promise<{
    safe: boolean;
    resolvedIp?: string;
    error?: string;
}>;
//# sourceMappingURL=webhook.d.ts.map