/**
 * DNS Pinning Protection
 *
 * Validates webhook IP consistency to prevent DNS rebinding attacks.
 *
 * @packageDocumentation
 */
/**
 * DNS Rebinding Attack Detection Result
 */
export interface DnsConsistencyResult {
    valid: boolean;
    reason?: string;
    currentIp?: string;
    storedIp?: string;
}
/**
 * Validate webhook IP consistency (DNS pinning).
 * Compares the currently resolved IP with the IP stored at registration time.
 * This prevents DNS rebinding attacks where an attacker:
 * 1. Registers webhook with attacker.com -> resolves to public IP (passes validation)
 * 2. Changes DNS: attacker.com -> 169.254.169.254 (AWS metadata)
 * 3. Webhook delivery resolves new DNS -> blocked because IP changed
 *
 * @param url The webhook URL to validate
 * @param storedIp The IP address stored at registration time
 * @returns Validation result with current and stored IPs for logging
 */
export declare function validateWebhookIpConsistency(url: string, storedIp: string | undefined): Promise<DnsConsistencyResult>;
//# sourceMappingURL=dns-pinning.d.ts.map