/**
 * SSRF guard — private/internal address detection.
 *
 * Extracted from http-client.ts so the function can be imported directly
 * in tests without a production-module test-only export (GEN-ARCH-03).
 */
/**
 * Returns true if the given hostname is a literal private or internal IPv4/IPv6
 * address that should never be the target of an HTTP redirect or pagination URL.
 *
 * Blocked ranges:
 * - Loopback:           127.0.0.0/8, ::1, 0.0.0.0 (Node routes locally)
 * - 0.x.x.x:           0.0.0.0/8 — locally routed on most platforms
 * - Link-local:         169.254.0.0/16, fe80::/10
 * - RFC1918:            10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
 * - IPv6 ULA:           fc00::/7 (fc and fd prefixes)
 * - IPv4-mapped IPv6:   ::ffff:0:0/96 (::ffff:<any IPv4>)
 * - CGNAT:              100.64.0.0/10 (100.64.0.0 – 100.127.255.255)
 * - Benchmark:          198.18.0.0/15 (198.18.x.x – 198.19.x.x)
 * - NAT64 well-known:   64:ff9b::/96 (IPv6 hostnames with 64:ff9b: prefix)
 *
 * Note: hostname is matched literally.  DNS names (e.g. "internal.corp") are NOT
 * resolved here — the goal is blocking literal private-IP Location values.
 * DNS-based SSRF via rebinding is a separate concern outside this guard.
 */
export declare function isPrivateAddress(hostname: string): boolean;
//# sourceMappingURL=private-address.d.ts.map