Module net_guard 

Network-safety primitives shared across crates that must reject SSRF and local/private targets. Lives in zeroclaw-infra so both the tool layer (zeroclaw-tools domain guard) and the plugin host (zeroclaw-plugins zc_http_request) read one implementation without a tool-to-plugin

Functions

is_non_global_v4

True when an IPv4 address is not globally routable (loopback, RFC 1918, link-local, CGNAT, documentation, benchmarking, reserved, multicast).

is_non_global_v6

True when an IPv6 address is not globally routable (loopback, ULA, link-local, documentation, multicast, or an IPv4-mapped non-global v4).

is_private_or_local_host

True when host is loopback, private, link-local, a documentation/ benchmark range, or one of the localhost / *.local name forms. Accepts bracketed IPv6 ([::1]) and is case-insensitive.