/**
 * SSRF (Server-Side Request Forgery) guard, shared by the agent's network-
 * touching surfaces.
 *
 * Used by:
 *   - toolExecution.ts  → the `fetch_url` tool (every redirect hop, pinned)
 *   - shell.ts          → curl/wget/http(s) arguments in execute_command
 *   - webFetch.ts       → redirect hops of a user's `@web` mention
 *
 * The URLs in the agent cases originate from model output / page content
 * (untrusted, prompt-injectable), so the agent must not be able to reach
 * internal services or the cloud metadata endpoint (169.254.169.254).
 * NOTE: this deliberately does NOT apply to user-configured provider base
 * URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
 * trusted config and never routed through agent tools.
 */
/**
 * Whether an IP literal points somewhere the agent must not reach. Brackets
 * are accepted (`[::1]`); anything that isn't an IP literal returns false —
 * hostnames are resolved by `resolveFetchTarget`, not judged by spelling.
 */
export declare function isBlockedIp(ip: string): boolean;
export type FetchTargetCheck = {
    ok: true;
    url: URL;
    /** Every checked address, to pin the connection to, so a second DNS
     *  answer can't swap in a private one (rebinding). All of them, not
     *  the first: a dual-stack host whose AAAA sorts first would otherwise
     *  be unreachable on a machine without a working IPv6 route. Undefined
     *  for IP literals — nothing to resolve — and when DNS failed. */
    addresses?: string[];
    /** True when the host was a name that did not resolve. */
    unresolved?: boolean;
} | {
    ok: false;
    reason: string;
};
/** Validate a URL and resolve its host, returning the verified address. */
export declare function resolveFetchTarget(rawUrl: string): Promise<FetchTargetCheck>;
/** Returns an error string if the URL must not be fetched, else null. */
export declare function assertFetchUrlAllowed(rawUrl: string): Promise<string | null>;