export interface PublicUrlAccepted {
    ok: true;
    url: URL;
    addresses: string[];
}
export interface PublicUrlRejected {
    ok: false;
    reason: string;
}
export type PublicUrlResult = PublicUrlAccepted | PublicUrlRejected;
/** Resolver seam so tests can inject DNS results without real lookups. */
export type AddressResolver = (hostname: string) => Promise<string[]>;
type ProxyEnvironment = Record<string, string | undefined>;
export type GuardedPublicFetchResult = {
    ok: true;
    response: Response;
    logicalUrl: URL;
    wireUrl: URL;
} | {
    ok: false;
    reason: string;
    logicalUrl: string;
};
export declare function hasConfiguredProxy(env: ProxyEnvironment): boolean;
/** True for any address that is not a routable public unicast address. */
export declare function isPrivateOrSpecialAddress(address: string): boolean;
/**
 * Validate that `rawUrl` is a public http/https target. Resolves DNS names and
 * rejects any that map to a private/special address. Never throws; returns a
 * discriminated result.
 */
export declare function validatePublicHttpUrl(rawUrl: string, options?: {
    resolver?: AddressResolver;
    signal?: AbortSignal;
}): Promise<PublicUrlResult>;
export declare function guardedPublicFetch(rawUrl: string, init?: BunFetchRequestInit, options?: {
    resolver?: AddressResolver;
}): Promise<GuardedPublicFetchResult>;
export declare function validatePublicHttpUrlForInsane(rawUrl: string, options?: {
    resolver?: AddressResolver;
}): Promise<PublicUrlResult>;
export {};