export type ResolveAddresses = (hostname: string) => Promise<string[]>;
export type ProbeTargetDecision = {
    allowed: true;
    address: string;
} | {
    allowed: false;
    reason: string;
};
/** Whether an address is a public unicast address a Cloud probe may contact. */
export declare function isPublicIpAddress(address: string): boolean;
/** Resolves every address of a probe hostname; injected in tests. */
export declare function resolveHostAddresses(hostname: string): Promise<string[]>;
/**
 * Decides whether a probe target may be contacted.
 *
 * Every resolved address has to be public, so a hostname that mixes public and private
 * records is refused instead of racing whichever record the connection picks.
 */
export declare function assertPublicProbeTarget(url: URL, resolveAddresses?: ResolveAddresses): Promise<ProbeTargetDecision>;
export interface HeadProbeRequestOptions {
    /** Address the connection is pinned to, already validated by the target policy. */
    address: string;
    timeoutMs: number;
}
export type HeadProbeRequest = (url: URL, options: HeadProbeRequestOptions) => Promise<{
    status: number;
    location?: string;
}>;
/**
 * HEAD request pinned to a validated address.
 *
 * Pinning is what makes the DNS check meaningful: without it the client would resolve the
 * hostname a second time and a rebinding answer could still reach a private address.
 */
export declare function createPinnedHeadProbeRequest(): HeadProbeRequest;