import type { LookupAddress } from "node:dns";
/** Result of validating a user-supplied URL before any outbound fetch. */
export interface SafePublicUrl {
    url: URL;
    /** Resolved addresses that passed private/bogon checks (empty when hostname is a literal public IP). */
    addresses: LookupAddress[];
}
export declare function isBlockedIp(ip: string): boolean;
export type ResolveAddresses = (hostname: string) => Promise<LookupAddress[]>;
/**
 * Parse + allow only http(s), resolve DNS, reject if ANY address is private/bogon/link-local/metadata.
 * Call again immediately before fetch to mitigate DNS rebinding (resolve → validate → re-check → fetch).
 */
export declare function assertSafePublicHttpUrl(raw: string, options?: {
    resolve?: ResolveAddresses;
}): Promise<SafePublicUrl>;
/**
 * DNS-rebinding defense: validate, then re-resolve and require the second lookup to still be public.
 * Prefer overlapping addresses with the first lookup when available.
 */
export declare function assertSafePublicHttpUrlPinned(raw: string, options?: {
    resolve?: ResolveAddresses;
}): Promise<SafePublicUrl>;