import { type SsrfResult } from '../../watch/ssrf.js';
/**
 * Serve-mode SSRF target guard. Layers a remote-exposure tightening on top of
 * the standard fetch guard: under a NON-loopback bind, loopback / localhost
 * literal target URLs are refused (a remote caller could otherwise probe the
 * box's own services — including this daemon's /admin — by URL). Unless
 * `WIGOLO_SERVE_ALLOW_LOCAL_TARGETS=1`. Literal check only — never claims DNS
 * rebinding coverage. Under a loopback bind, behaviour is the standard fetch
 * guard (local dev servers keep working).
 *
 * Shared seam consumed by the fetch route (T1) and every URL-bearing route +
 * the Firecrawl shim (T2/T4) — the shim cannot escape it.
 */
export declare function guardServeTarget(raw: string, opts: {
    bindIsLoopback: boolean;
}): SsrfResult;
//# sourceMappingURL=target-guard.d.ts.map