import { Logger, TypedEmitter } from '@n8n/backend-common';
import { SsrfProtectionConfig } from '@n8n/config';
import { type Result } from '@n8n/utils/result';
import type { LookupFunction } from 'node:net';
import { DnsResolver } from '../dns';
export type SsrfCheckResult = Result<void, Error>;
type SsrfBlockedReason = 'blocked_ip' | 'blocked_hostname' | 'invalid_url' | 'dns_error';
type SsrfBlockedPayload = {
    phase: SsrfPhase;
    reason: SsrfBlockedReason;
    durationMs: number;
};
type SsrfAllowedPayload = {
    phase: SsrfPhase;
    durationMs: number;
};
type SsrfPhase = 'pre_flight' | 'connect_time' | 'redirect';
export type SsrfEventMap = {
    'ssrf.blocked': SsrfBlockedPayload;
    'ssrf.allowed': SsrfAllowedPayload;
};
export interface SsrfBridge {
    validateIp(ip: string): SsrfCheckResult;
    validateUrl(url: string | URL): Promise<SsrfCheckResult>;
    validateConnectionHost(host: string): SsrfCheckResult;
    validateRedirectSync(url: string): void;
    createSecureLookup(): LookupFunction;
}
export declare class SsrfProtectionService implements SsrfBridge {
    private readonly ssrfConfig;
    private readonly dnsResolver;
    readonly events: TypedEmitter<SsrfEventMap>;
    private readonly logger;
    private readonly blockedIps;
    private readonly allowedIps;
    private readonly allowedHostnameMatcher;
    private readonly blockedHostnameMatcher;
    constructor(ssrfConfig: SsrfProtectionConfig, dnsResolver: DnsResolver, logger: Logger);
    validateUrl(url: string | URL): Promise<SsrfCheckResult>;
    validateIp(ip: string): SsrfCheckResult;
    validateConnectionHost(host: string): SsrfCheckResult;
    createSecureLookup(): LookupFunction;
    validateRedirectSync(url: string): void;
    private normalizeIpInHostname;
    private secureLookupAsync;
    private lookupAndValidate;
    private withEvents;
    private toReason;
    private tryParseUrl;
    private getIpFamily;
}
export {};