export declare function isBlockedExtensionUrl(url: string): boolean;
export declare function isBlockedExtensionUrlWithDns(url: string): Promise<boolean>;
export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonly string[], destinationUrl?: string, options?: {
    required?: boolean;
}): Promise<unknown>;
/**
 * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
 *
 * Applies the same protections the extension proxy uses, so every call site
 * that fetches an untrusted URL gets them without re-implementing the loop:
 *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
 *      on the initial URL and on every redirect hop.
 *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
 *      time (closes the DNS-rebinding TOCTOU) when the runtime supports the
 *      Node dispatcher. Edge runtimes retain preflight DNS checks, literal and
 *      rebinding-domain rejection, and per-hop redirect validation.
 *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
 *      private network because each hop is re-validated before it is followed.
 *
 * Throws an Error whose message starts with "SSRF blocked:" when a target
 * (initial or via redirect) resolves to a private/internal address, or when the
 * redirect limit is exceeded. Otherwise returns the final Response.
 *
 * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
 * followed only to `https:` targets, so an HTTPS-only caller cannot be
 * downgraded to plain HTTP by a 30x from the (untrusted) origin.
 *
 * `assertUrlAllowed` lets callers layer a stricter destination policy (for
 * example, a credential's origin allowlist) on top of the SSRF checks. It runs
 * before the initial request and before every redirect hop, so sensitive
 * headers and bodies are never forwarded to a destination the caller rejects.
 */
export declare function ssrfSafeFetch(url: string, init?: RequestInit, options?: {
    maxRedirects?: number;
    followRedirects?: boolean;
    requireDispatcher?: boolean;
    httpsOnly?: boolean;
    assertUrlAllowed?: (url: string) => void | Promise<void>;
    allowedPrivateOrigins?: readonly string[];
}): Promise<Response>;
export { isBlockedExtensionUrl as isBlockedToolUrl };
export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };
export { ssrfSafeFetch as ssrfSafeToolFetch };