/**
 * http_fetch's address checks and connection-pinned transport (ADR-164 §5.1.8).
 *
 * Checking the URL's hostname string is not enough: a public-looking name can resolve to
 * loopback, RFC-1918 or cloud metadata (169.254.169.254), and `fetch()` resolves the name
 * again on its own, so even a pre-resolution check can be rebound (TTL-0 DNS) between the
 * check and the connect. Here the socket's DNS lookup *is* the check: `pinnedLookup`
 * resolves the name, refuses it when any address is private, and hands the socket only the
 * addresses it checked, so the connection cannot land anywhere else. IP-literal hosts never
 * reach a lookup; `validateUrl` checks those by text, with the same `isPrivateOrLoopback`.
 *
 * @module @claude-flow/cli/mcp-tools/http-fetch-pinned
 */
import { type LookupFunction } from 'node:net';
/** Raised when a hostname resolves to an address the allowlist refuses. */
export declare class PrivateAddressError extends Error {
    readonly code = "PRIVATE_ADDRESS";
    constructor(host: string, address: string);
}
export declare const allowPrivateAddresses: () => boolean;
/**
 * Whether a host (an IP literal, bracketed or not, or `localhost`) is one http_fetch refuses
 * by default. A name that is not an IP literal is `false` here: what it resolves to is
 * checked at connect time by `pinnedLookup`.
 */
export declare function isPrivateOrLoopback(host: string): boolean;
/**
 * The socket's DNS lookup: resolve every address, refuse the host when any of them is
 * private (unless opted in), and return only those checked addresses to the socket.
 */
export declare const pinnedLookup: LookupFunction;
export interface PinnedInit {
    method: string;
    headers: Record<string, string>;
    body?: string;
    signal: AbortSignal;
}
/**
 * One HTTP(S) request whose connection goes only to an address `pinnedLookup` checked, with
 * no redirect following and a fresh connection every time (no pooled socket from elsewhere).
 * Returns a standard `Response` so the caller reads it as it would a `fetch()` result.
 */
export declare function pinnedRequest(url: string, init: PinnedInit): Promise<Response>;
//# sourceMappingURL=http-fetch-pinned.d.ts.map