/**
 * Network egress guard — shared SSRF helper.
 *
 * Two SSRF surfaces in this codebase build their own private-host check:
 *   - `validateSearxngUrl` (src/modules/search/engines.ts) — fetches an
 *     arbitrary, user/tenant-supplied SearXNG base URL. No allowlist, so a
 *     bypass here is a *reachable* SSRF (probe internal services, hit cloud
 *     metadata at 169.254.169.254).
 *   - `validateDownloadUrl` (src/modules/image/index.ts) — has a CDN
 *     allowlist on top, but still runs the private-host check as a layer.
 *
 * Both previously matched a regex against `url.hostname`. That misses the
 * IPv6-mapped-IPv4 form: `https://[::ffff:169.254.169.254]/…` normalises to
 * hostname `[::ffff:a9fe:a9fe]`, which `/^169\.254\./` never matches — a
 * textbook SSRF-to-metadata bypass. Decimal / octal / hex IPv4 (`2130706433`,
 * `0x7f000001`, `0177.0.0.1`, `127.1`) are *not* a problem because the WHATWG
 * URL parser normalises those to dotted-quad before we see `hostname`, but the
 * v6-mapped form is left untouched.
 *
 * This module centralises the check so both surfaces share one correct,
 * tested implementation.
 */
/**
 * If `host` is (or embeds) an IPv4 address, return it in dotted-quad form.
 * Handles the plain dotted form and the IPv6-mapped/compat forms
 * (`::ffff:a.b.c.d`, `::ffff:7f00:1`, `::a.b.c.d`). Returns undefined when the
 * host is not an IPv4 / v4-mapped address (e.g. a real DNS name or a genuine
 * global IPv6 address).
 */
export declare function extractIpv4(rawHost: string): string | undefined;
/** True when a dotted-quad IPv4 string falls in a private / reserved range. */
export declare function isPrivateIpv4(ip: string): boolean;
/**
 * Decide whether a URL hostname points at a private / internal / loopback
 * destination that must never be fetched server-side.
 *
 * Covers: literal loopback names, `.localhost` / `.local` / `.internal`
 * suffixes, all private + reserved IPv4 ranges (including via decimal/hex/octal
 * normalisation done by the URL parser), IPv6 loopback / ULA / link-local, and
 * — the gap this module exists to close — IPv6-mapped IPv4 addresses.
 */
export declare function isPrivateHostname(rawHostname: string): boolean;
//# sourceMappingURL=net-guard.d.ts.map