/**
 * SSRF guard for Web-Push endpoints.
 *
 * An authenticated user supplies the push `endpoint` URL, and the server later
 * does `fetch(endpoint, …)` to deliver notifications (see `push.ts`). Without a
 * guard a user could point the endpoint at an internal address
 * (`https://169.254.169.254/…` for cloud metadata, `https://127.0.0.1/…`,
 * RFC 1918 ranges) and turn the push sender into an SSRF probe.
 *
 * The baseline guard is: HTTPS only, and reject literal private / loopback /
 * link-local / unspecified IP hosts (v4 and v6) plus localhost names. An
 * optional host allowlist narrows further to known push services.
 *
 * Note: this checks the URL host, not a resolved IP — it is not a defense
 * against DNS rebinding (a public name resolving to a private IP). Pair with an
 * egress firewall / `allowedHosts` allowlist where that matters.
 */
/**
 * True when `endpoint` is a syntactically valid HTTPS URL to a host that is not
 * a private/loopback/link-local IP literal or a localhost name.
 */
export declare function isPublicHttpsEndpoint(endpoint: unknown): boolean;
/**
 * Full acceptance check for a push endpoint: the baseline {@link
 * isPublicHttpsEndpoint} guard plus, when `allowedHosts` is non-empty, a
 * suffix-match allowlist (`'push.apple.com'` matches `web.push.apple.com`).
 */
export declare function isAllowedPushEndpoint(endpoint: unknown, allowedHosts?: string[]): boolean;