export interface ResolvedWebhookUrl {
    url: string;
    addresses: ReadonlyArray<{
        address: string;
        family: 4 | 6;
    }>;
}
export interface WebhookUrlPolicy {
    validateForStorage(value: string): string;
    resolveForDelivery(value: string): Promise<ResolvedWebhookUrl>;
}
export interface StrictWebhookUrlPolicyOptions {
    allowedPorts?: readonly number[];
    resolve?: (hostname: string) => Promise<ReadonlyArray<{
        address: string;
        family: 4 | 6;
    }>>;
}
/**
 * Rejects credentials, non-HTTPS URLs, local hostnames, non-approved ports, and
 * every non-public resolved address. Delivery transports must pin their socket to
 * one of the returned addresses so DNS rebinding cannot bypass this decision.
 */
export declare class StrictWebhookUrlPolicy implements WebhookUrlPolicy {
    private readonly allowedPorts;
    private readonly resolve;
    constructor(options?: StrictWebhookUrlPolicyOptions);
    validateForStorage(value: string): string;
    resolveForDelivery(value: string): Promise<ResolvedWebhookUrl>;
}
export declare function isPublicAddress(value: string): boolean;
//# sourceMappingURL=ssrf.d.ts.map