/** True for any loopback, private, link-local, or unique-local address (v4 or v6). */
export declare function isPrivateIp(ip: string): boolean;
/**
 * Resolve a host and judge whether any of its addresses is private. IP literals (incl.
 * bracketed IPv6) skip DNS. Fails closed: an unresolvable or lookup-erroring host is treated
 * as unsafe (returns true), so the caller refuses rather than throwing.
 */
export declare function hostResolvesPrivate(host: string): Promise<boolean>;
export type Refusal = "host-mismatch" | "private-ip" | "redirect-escape";
export type Resolution = {
    ok: true;
    addresses: string[];
} | {
    ok: false;
    refused: Refusal;
};
/**
 * Resolve a request/redirect target to the validated public addresses the connection
 * must pin to, or a refusal. The target must be the registered host (an off-host initial
 * request is "host-mismatch", an off-host redirect is "redirect-escape"); the resolved set
 * must be non-empty and every address public, else "private-ip". IP literals (incl.
 * bracketed IPv6) skip DNS. Fails closed: a lookup error or empty result is a refusal.
 *
 * This is the single DNS lookup for a call. The caller pins the socket to the returned
 * addresses so `fetch` performs no second, independent lookup — closing the window where
 * a host could answer public here and private to the connect-time lookup.
 */
export declare function resolveTarget(targetHost: string, registeredHost: string, kind: "request" | "redirect"): Promise<Resolution>;
//# sourceMappingURL=ssrf.d.ts.map