export type GitNetworkProtocol = 'https' | 'ssh';
export interface GitNetworkTarget {
    protocol: GitNetworkProtocol;
    hostname: string;
    port: number;
    /** The exact name (and optional port) whose SSH key was accepted by the operator. */
    hostKeyAlias?: string;
}
export interface PinnedGitTarget extends GitNetworkTarget {
    /** Public addresses captured in one DNS answer and reused for the whole Git operation. */
    addresses: readonly string[];
}
export type GitHostResolver = (hostname: string) => Promise<readonly string[]>;
export declare class GitEgressError extends Error {
    constructor(message: string);
}
/**
 * True only for ordinary globally routable unicast destinations.
 *
 * This intentionally rejects documentation, benchmarking, transition,
 * multicast and address-translation ranges as well as RFC1918/link-local
 * space. A Git forge has no operational reason to live on one of them, and
 * allowing them turns a repository URL into a network probe.
 */
export declare function isPublicGitAddress(value: string): boolean;
/** Parse the only remote protocols the credential-bearing Agent permits. */
export declare function gitNetworkTarget(repository: string): GitNetworkTarget | null;
export declare const resolveSystemGitHost: GitHostResolver;
/**
 * Resolve once, reject the complete answer if any address is not public, and
 * return only the captured addresses. Git must then be forced to use these
 * values rather than resolving the hostname again.
 */
export declare function resolvePinnedGitTarget(repository: string, resolveHost?: GitHostResolver): Promise<PinnedGitTarget | null>;
export declare const curlResolveValue: (target: PinnedGitTarget) => string;