SSRF Preflight Endpoint Validator (inference/endpoint-ssrf-preflight.ts)

Validates that an inference endpoint resolves to a public address, preserving trusted private inference routes and preventing SSRF attacks.

// Source: https://github.com/mperkins0155/NemoClaw | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

import {
  assertEndpointResolvesPublic as assertSharedEndpointResolvesPublic,
  type EndpointDnsLookupFn,
  type EndpointSsrfPreflightOptions,
  type EndpointSsrfPreflightResult,
  isOpenShellManagedHost,
  parseTrustedPrivateHosts,
} from "../security/trusted-private-endpoint";

export * from "../security/trusted-private-endpoint";
export { parseTrustedPrivateHosts as parseTrustedPrivateInferenceHosts } from "../security/trusted-private-endpoi

... (truncated -- full source via MCP)