import type { SecureFetchGuard } from './secure-fetch.js';
/** Check if an IPv4 address is in a private/reserved range */
export declare function isPrivateIPv4(ip: string): boolean;
/** Check if an IPv6 address is in a private/reserved range */
export declare function isPrivateIPv6(ip: string): boolean;
/**
 * Validated URL with pinned IP addresses to prevent DNS rebinding.
 * The resolved IPs are captured at validation time and should be used for the actual
 * connection to prevent TOCTOU DNS rebinding attacks.
 */
export interface ValidatedUrl {
    url: string;
    /** Pinned IPv4 addresses resolved at validation time */
    pinnedIPv4: string[];
}
/**
 * Validate that a URL is external (HTTPS, not pointing to internal/private addresses).
 * Resolves hostname via DNS to catch rebinding bypasses. Returns pinned IPs for the caller
 * to use when making the actual request.
 */
export declare function validateExternalUrl(urlStr: string): Promise<ValidatedUrl>;
/** A net.LookupFunction-compatible resolver that pins DNS resolution to the given
 *  already-validated public IPv4 address(es), ignoring the hostname. This is what makes
 *  the connection immune to DNS rebinding: no matter what an attacker-controlled DNS
 *  record returns at connect time, the socket only ever connects to the pre-validated IPs.
 *  Supports both the single-address and `{ all }` callback forms. Exported for tests. */
export declare function createPinnedLookup(pinnedIPv4: string[]): (hostname: string, opts: {
    all?: boolean;
} | undefined, cb: (err: Error | null, address: unknown, family?: number) => void) => void;
/** Create the default SSRF guard for `secureFetch` over untrusted URLs (x402 targets,
 *  registry-discovered endpoints): validates the URL (HTTPS, non-private/reserved IP,
 *  DNS-resolvable) and returns a connection dispatcher pinned to the validated IPs. Throws
 *  (AzethError) to BLOCK the request. This is the secure-by-default guard the SDK's client
 *  methods inject unless the caller supplies their own guard or opts out. */
export declare function createDefaultSsrfGuard(): SecureFetchGuard;
//# sourceMappingURL=ssrf-guard.d.ts.map