/**
 * ssrf.ts — Server-Side Request Forgery guard.
 *
 * Blocks URLs that resolve to private / internal / metadata addresses
 * by default. Opt in to private ranges with `--allow-private` / the
 * `allowPrivate` option on `validateUrl`.
 *
 * Blocked ranges:
 *   - Loopback:         127.0.0.0/8, ::1
 *   - Link-local:       169.254.0.0/16, fe80::/10  (includes AWS metadata 169.254.169.254)
 *   - Private (RFC1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
 *   - Unique local:      fc00::/7  (IPv6 ULA)
 *   - Metadata:         fd00:ec2::254 (AWS IPv6 metadata)
 *
 * Redirects are re-checked at each hop so a public URL that redirects
 * to an internal address is still blocked.
 */
/** Configuration for a single URL safety check. */
export interface SsrfOptions {
    /**
     * When true, allow URLs that resolve to private / loopback / link-local
     * ranges. Default: false (block).
     */
    allowPrivate?: boolean;
}
/**
 * Thrown when a URL is blocked by the SSRF guard.
 * The `address` field is the resolved IP that triggered the block.
 */
export declare class SsrfBlockedError extends Error {
    readonly address: string;
    readonly range: string;
    constructor(address: string, range: string);
}
/**
 * Assert that a URL is safe to fetch under the current SSRF policy.
 *
 * Resolves the URL's hostname, classifies every resolved IP address,
 * and throws `SsrfBlockedError` if any of them fall into a blocked
 * range — unless `allowPrivate` is set.
 *
 * @param url       The URL that will be fetched.
 * @param options   SSRF options (currently just `allowPrivate`).
 */
export declare function assertSafeUrl(url: string, options?: SsrfOptions): Promise<void>;
//# sourceMappingURL=ssrf.d.ts.map