import { type LookupFunction } from "node:net";
export type ResolvedWebhookAddress = Readonly<{
    address: string;
    family: 4 | 6;
}>;
/**
 * One HTTP(S) request whose connection is pinned to an address that already
 * passed the public-address policy.
 */
export type PinnedHttpRequest = Readonly<{
    url: string;
    address: ResolvedWebhookAddress;
    method: "GET" | "HEAD" | "POST";
    headers: Readonly<Record<string, string>>;
    body?: string;
    signal: AbortSignal;
}>;
export type PinnedHttpResponse = Readonly<{
    status: number;
    /** Raw Location header so callers can revalidate every redirect hop. */
    location?: string;
}>;
export type PinnedHttpSender = (input: PinnedHttpRequest) => Promise<PinnedHttpResponse>;
type PinnedWebhookRequest = Readonly<{
    url: string;
    address: ResolvedWebhookAddress;
    headers: Readonly<Record<string, string>>;
    body: string;
    signal: AbortSignal;
}>;
type PinnedWebhookResponse = Readonly<{
    ok: boolean;
    status: number;
}>;
/**
 * A lookup that ignores the hostname and answers with the validated address,
 * so the connection cannot re-resolve DNS between validation and connect.
 * It supports both the single-address and the `all: true` callback forms.
 */
export declare function createPinnedLookup(address: ResolvedWebhookAddress): LookupFunction;
/**
 * Send one HTTP(S) request pinned to a validated address. The URL hostname
 * still drives the Host header, TLS SNI, and certificate verification; only
 * the connection target is fixed. A fresh agent prevents reusing a socket
 * opened for another validation, and the response body is never read. Every
 * failure, including an unparseable URL, is reported as a rejection.
 */
export declare function sendPinnedHttpRequest(input: PinnedHttpRequest): Promise<PinnedHttpResponse>;
/** Try each validated address in order until one of them answers. */
export declare function sendPinnedHttpRequestWithFallback(input: Omit<PinnedHttpRequest, "address"> & Readonly<{
    addresses: readonly ResolvedWebhookAddress[];
    totalTimeoutMs?: number;
}>, send?: PinnedHttpSender): Promise<PinnedHttpResponse>;
export declare function postPinnedHttpsWebhookWithFallback(input: Readonly<{
    url: string;
    addresses: readonly ResolvedWebhookAddress[];
    headers: Readonly<Record<string, string>>;
    body: string;
    signal: AbortSignal;
}>, send?: (input: PinnedWebhookRequest) => Promise<PinnedWebhookResponse>): Promise<PinnedWebhookResponse>;
export {};