/**
 * SSRF protection for the scanner endpoint.
 *
 * Validates URLs against an allowlist of public code hosting providers.
 * Rejects private IP ranges, localhost, and link-local addresses.
 * Prevents DNS rebinding by resolving hostnames before making requests.
 *
 * Canonical location: src/security/ssrf-guard.ts
 * Re-exported from: packages/governance-server/src/ssrf-guard.ts
 *
 * @connexum/ai-governance
 */
export interface SsrfCheckResult {
    safe: boolean;
    reason?: string;
    resolvedIp?: string;
}
export declare function checkUrl(url: string, allowCustomHosts?: boolean): Promise<SsrfCheckResult>;
/**
 * Add a custom allowed host (for enterprise tier).
 */
export declare function addAllowedHost(host: string): void;
/**
 * Get the current allowed hosts list.
 */
export declare function getAllowedHosts(): string[];
/**
 * Register a session-scoped loopback allowance.
 * Returns the token that must be passed to checkUrlWithSession.
 * Call revokeLoopbackSession(token) when the adapter is torn down.
 */
export declare function registerLoopbackSession(token: string): void;
/**
 * Revoke a previously registered loopback session.
 */
export declare function revokeLoopbackSession(token: string): void;
/**
 * Session-aware URL check. If the request is to a loopback address
 * (127.0.0.1 or ::1) and sessionToken is a registered loopback session,
 * the check is allowed. All other requests fall through to checkUrl().
 *
 * This is the entry point adapters should use when they need loopback access.
 */
export declare function checkUrlWithSession(url: string, sessionToken: string | undefined): Promise<SsrfCheckResult>;
//# sourceMappingURL=ssrf-guard.d.ts.map