export interface ResolvedAddress {
    address: string;
    family: number;
}
export type Resolver = (hostname: string) => Promise<readonly ResolvedAddress[]>;
export interface EgressPolicyOptions {
    /** Operator-controlled allowlists; defaults to HTTP 80 and HTTPS 443 only. */
    ports?: Partial<Record<"http:" | "https:", readonly number[]>>;
    resolver?: Resolver;
}
export interface ValidatedEndpoint {
    url: URL;
    pinnedAddress: string;
    family: 4 | 6;
    hostKey: string;
}
export declare function assertPublicAddress(address: string): void;
export declare function hostBudgetKey(url: URL): string;
/** Pure syntactic/literal policy check; no DNS or budget is consumed. */
export declare function validateUrl(raw: string | URL, options?: EgressPolicyOptions): URL;
export declare class EgressPolicy {
    private readonly options;
    constructor(options?: EgressPolicyOptions);
    validateUrl(raw: string | URL): URL;
    validate(raw: string | URL): Promise<ValidatedEndpoint>;
}