/**
 * Shared IP-address guards for SSRF protection.
 *
 * Exported so `fetch.ts` (tools), `web-search/index.ts` (plugins), and any
 * other package that needs to validate IPs can all consume the same logic.
 * Any future additions (e.g. extra CIDR blocks) need only be made here.
 */
/**
 * True if `addr` is in a private / loopback / link-local / reserved / CGNAT /
 * multicast range.  `net.isIP` is called by the caller first so `addr` is
 * guaranteed to be a canonical dotted-quad at this point.
 */
export declare function isPrivateIPv4(addr: string): boolean;
/**
 * True if `raw` (an IPv6 literal, already lowercased) is loopback / unique-local /
 * link-local / unspecified / IPv4-mapped-private.
 */
export declare function isPrivateIPv6(raw: string): boolean;
/**
 * Expand an IPv6 string into exactly 8 16-bit numbers.  Handles `::` compression.
 * Returns null on malformed input — caller should treat that as "block".
 */
export declare function expandIPv6(addr: string): number[] | null;
/**
 * Convenience: throw if `hostname` resolves to a private / loopback IP.
 * Use as a pre-flight check before opening a socket.
 *
 * ⚠️  This is not sufficient alone — connections must also use a pinned
 * dispatcher (so the OS re-uses the already-resolved address) or the same
 * check must be applied after every redirect hop.  See `guardedLookup` in
 * `fetch.ts` for the connection-level enforcement.
 */
export declare function assertNotPrivateHost(hostname: string): Promise<void>;
//# sourceMappingURL=ip-guard.d.ts.map