/** Guard run before connecting to a URL (and again before every redirect hop).
 *  - Throws to BLOCK the request (e.g. non-HTTPS, private/reserved IP, DNS failure).
 *  - May return an optional connection `dispatcher` (undici `Agent`) pinned to the
 *    validated IP(s). The SDK passes it through to `fetch()` (a Node/undici extension);
 *    it is `unknown` here so the SDK stays portable and free of Node-only imports. */
export type SecureFetchGuard = (url: string) => Promise<{
    dispatcher?: unknown;
}>;
/** Redirect handling for guarded requests. */
export type GuardedRedirectPolicy = 
/** Re-validate each Location and follow public ones (use for idempotent, credential-free reads). */
'follow'
/** Reject on ANY redirect (use for requests carrying payment proof / SIWx / credentials). */
 | 'error';
export interface SecureFetchOptions extends RequestInit {
    /** SSRF guard + optional connection pin. Omit for trusted/SDK-direct calls (passthrough). */
    guard?: SecureFetchGuard;
    /** Redirect policy when `guard` is set. Default: 'follow'. */
    guardedRedirect?: GuardedRedirectPolicy;
    /** Max redirects to follow when `guardedRedirect: 'follow'`. Default: 3. */
    maxRedirects?: number;
}
/** SSRF-hardened fetch. See module docs. */
export declare function secureFetch(url: string, opts?: SecureFetchOptions): Promise<Response>;
//# sourceMappingURL=secure-fetch.d.ts.map