/**
 * SSRF guard for server-side outbound fetches of user-supplied URLs.
 *
 * Blocks requests to private, loopback, link-local, and cloud-metadata addresses
 * so an attacker cannot use a "fetch this URL" feature (e.g. upload-from-URL) to
 * reach internal services or steal cloud credentials.
 *
 * Defenses:
 *  - scheme allowlist (http/https only)
 *  - resolve the hostname to IPs and block dangerous ranges (checks the RESOLVED
 *    address, not just the hostname — defeats `evil.com → 127.0.0.1`)
 *  - validate every redirect hop (the caller follows redirects manually)
 *
 * Override: SSRF_ALLOW_PRIVATE_URL_FETCH=true disables the private-range block
 * (e.g. for a trusted internal-only deployment). Scheme validation still applies.
 */
/**
 * Decide whether an IP address is in a range we must never fetch from.
 * Covers loopback, private (RFC1918 / ULA), link-local (incl. cloud metadata
 * 169.254.169.254), and other non-public ranges, for both IPv4 and IPv6.
 */
export declare function isBlockedIp(ip: string): boolean;
/**
 * Validate that a single URL is safe to fetch: allowed scheme, and (unless the
 * private-fetch override is set) every resolved IP is in a public range.
 * @throws Error describing why it was rejected.
 */
export declare function assertSafeFetchUrl(rawUrl: string): Promise<void>;
//# sourceMappingURL=ssrfGuard.d.ts.map