import type { ToolResult } from "../types.js";
import { isBlockedAddress } from "./web/ssrf-guard.js";
import { type OutputSelection, type ResponsePart } from "./output-selection.js";
/** True when the error is a TLS hostname/cert mismatch (common for https://IP). */
export declare function isTlsCertNameError(error: unknown): boolean;
/**
 * Block (or require explicit ownership confirmation for) requests that
 * target loopback, private, link-local, or cloud-metadata addresses.
 *
 * The classification logic now lives in {@link "./web/ssrf-guard"} so that
 * `http.fetch` and the new `web.fetch` tool share a single source of truth
 * for SSRF rules. This file re-exports `isBlockedAddress` for callers that
 * still import it from `../tools/http`, but the implementation is the
 * structured classifier in `web/ssrf-guard.ts`.
 */
export { isBlockedAddress };
/** True for loopback hostnames / IPs (local dev servers). */
export declare function isLoopbackHost(hostname: string): boolean;
/**
 * Vite/macOS often listens on only one of IPv4/IPv6. Browser "localhost"
 * works dual-stack; a single-address probe can false-fail. Return ordered
 * candidates: original host first, then the other loopback form(s).
 */
export declare function loopbackUrlCandidates(url: string): string[];
interface FetchOptions extends OutputSelection {
    method?: string | undefined;
    body?: string | undefined;
    headers?: Record<string, string> | undefined;
    maxBytes?: number | undefined;
    iOwnThis?: boolean | undefined;
    retries?: number | undefined;
    /** Request timeout in ms (clamped 1s–30min). Default 40s. */
    timeoutMs?: number | undefined;
    /** HTML body formatting; raw is the forensic default. */
    responseMode?: "readable" | "raw" | undefined;
    responsePart?: ResponsePart | undefined;
    /**
     * Forward credentials across an origin-changing redirect. Disabled by
     * default so an in-scope endpoint cannot leak supplied auth to another host.
     */
    forwardSensitiveHeaders?: boolean | undefined;
    /**
     * Skip TLS certificate verification (hostname mismatch / self-signed).
     * For authorized pentest against https://IP or lab certs only. Evidence
     * will note that verification was disabled.
     */
    insecureTls?: boolean | undefined;
    signal?: AbortSignal | undefined;
    authorizeHop?: ((url: string, resolvedAddresses: string[]) => Promise<{
        allowed: boolean;
        reason: string;
    }> | {
        allowed: boolean;
        reason: string;
    }) | undefined;
}
export declare function httpFetch(url: string, options?: FetchOptions): Promise<ToolResult>;