export declare function isBlockedSsrfHost(hostname: string): boolean;
/**
 * Fetch with per-redirect-hop SSRF re-validation. Node's `fetch` follows
 * redirects automatically, so a public URL can 302 to 169.254.169.254 / a
 * loopback service — checking only the initial host is useless. This follows
 * redirects MANUALLY, re-running isBlockedSsrfHost on every hop. `allow=true`
 * (FRANKLIN_ALLOW_PRIVATE_FETCH) skips the check for local dev servers.
 */
export declare function ssrfSafeFetch(url: string, init?: RequestInit & {
    allowPrivate?: boolean;
}, maxHops?: number): Promise<Response>;