export declare function isBlockedExtensionUrl(url: string): boolean;
/**
 * Async SSRF guard for environments that can resolve DNS. The synchronous
 * guard catches literals and known rebinding domains; this closes the common
 * "public hostname resolves to a private address" gap before dispatch.
 */
export declare function isBlockedExtensionUrlWithDns(url: string): Promise<boolean>;
export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonly string[]): Promise<unknown | null>;
/**
 * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
 *
 * Applies the same protections the extension proxy uses, so every call site
 * that fetches an untrusted URL gets them without re-implementing the loop:
 *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
 *      on the initial URL and on every redirect hop.
 *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
 *      time (closes the DNS-rebinding TOCTOU) when undici is available.
 *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
 *      private network because each hop is re-validated before it is followed.
 *
 * Throws an Error whose message starts with "SSRF blocked:" when a target
 * (initial or via redirect) resolves to a private/internal address, or when the
 * redirect limit is exceeded. Otherwise returns the final Response.
 *
 * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
 * followed only to `https:` targets, so an HTTPS-only caller cannot be
 * downgraded to plain HTTP by a 30x from the (untrusted) origin.
 *
 * `assertUrlAllowed` lets callers layer a stricter destination policy (for
 * example, a credential's origin allowlist) on top of the SSRF checks. It runs
 * before the initial request and before every redirect hop, so sensitive
 * headers and bodies are never forwarded to a destination the caller rejects.
 */
export declare function ssrfSafeFetch(url: string, init?: RequestInit, options?: {
    maxRedirects?: number;
    httpsOnly?: boolean;
    assertUrlAllowed?: (url: string) => void | Promise<void>;
    /**
     * Exact origins that may resolve to a private address. A workspace runs
     * every app on loopback behind one gateway, so sibling A2A calls are
     * private by construction; without this they are indistinguishable from an
     * SSRF attempt and get blocked. Only ever pass origins the deployment
     * itself configured (never a request-supplied value).
     */
    allowedPrivateOrigins?: readonly string[];
}): Promise<Response>;
export { isBlockedExtensionUrl as isBlockedToolUrl };
export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };
export { ssrfSafeFetch as ssrfSafeToolFetch };
//# sourceMappingURL=url-safety.d.ts.map