/**
 * notifications/egress-guard.ts
 *
 * SSRF guard for outbound webhook delivery. Requires https and rejects any
 * URL whose host resolves into a reserved/internal IP range (RFC 1918 private,
 * loopback, link-local — including the 169.254.169.254 cloud-metadata endpoint,
 * IPv6 unique-local, 0.0.0.0/8, multicast). The resolved IP is checked at call
 * time so a DNS-rebinding host that points public-then-internal is still caught.
 *
 * The blocked ranges are fixed RFC/IANA constants — nothing is operator-tuned.
 */
export declare class EgressBlockedError extends Error {
    constructor(message: string);
}
/** Injectable resolver so tests assert range logic without real DNS. */
export interface EgressGuardOptions {
    resolve?: (hostname: string) => Promise<string>;
}
export declare function assertSafeEgressUrl(raw: string, options?: EgressGuardOptions): Promise<void>;
/** True when an IP literal falls in a reserved/internal range. */
export declare function isReservedIp(ip: string): boolean;
