export interface ClassificationResult {
    blocked: boolean;
    /** Stable human-readable reason. Surfaced in SSRF error messages + audit logs. */
    reason?: string;
    /** Which rule matched (CIDR string + category) — exposed for diagnostics. */
    rule?: string;
}
/**
 * Classify an IPv4 address against the SSRF block list. Exported for the
 * IPv4-mapped IPv6 recursion path and for direct callers who already
 * know they have a v4 literal.
 */
export declare function classifyIPv4(ip: string): ClassificationResult;
/**
 * Classify an IPv6 address against the SSRF block list. Handles IPv4-
 * mapped IPv6 by delegating to classifyIPv4 with the embedded octets —
 * covered by both dotted-mixed `::ffff:1.2.3.4` and all-hex
 * `::ffff:0102:0304` forms.
 */
export declare function classifyIPv6(ip: string): ClassificationResult;
/**
 * Unified classifier. Picks family based on `net.isIP`. Safe to call with
 * any string — invalid inputs are reported as blocked.
 */
export declare function classifyIp(ip: string): ClassificationResult;
/**
 * Shorthand for SSRF callers that want a boolean + reason. Equivalent to
 * classifyIp but named for readability at webhook-validate + dashboard-
 * focus call sites.
 */
export declare function isBlockedForSsrf(ip: string): ClassificationResult;
//# sourceMappingURL=ip-classifier.d.ts.map