/**
 * MCP-facing SSRF API.
 *
 * Logic now lives in src/net/ssrf-strict.ts so the SSH preflight can share it.
 * This file is a thin re-export — existing imports from `src/mcp/ssrf-strict.js`
 * keep working unchanged.
 */
export {
  isPrivateOrForbidden,
  checkSSRFStrict,
  pinnedFetch,
  resolveAndCheck,
  pinnedConnect,
} from '../net/ssrf-strict.js';
export type {
  LookupFn,
  SsrfResult,
  PinnedFetchOptions,
  ResolveCheckArgs,
  ResolveCheckResult,
  PinnedConnectArgs,
} from '../net/ssrf-strict.js';
