<?php

declare(strict_types=1);

namespace Plugin\tnt_mcp\src\Http;

/**
 * A URL that {@see UrlGuard} has already cleared, together with the addresses it resolved to.
 *
 * The addresses travel with the URL for one reason: the connection must go to the SAME address the
 * guard approved. Resolving twice — once to check, once to connect — is the DNS-rebinding hole this
 * class exists to close.
 */
final class GuardedTarget
{
    /**
     * @param list<string> $ips every address the host resolved to, all of them public
     */
    public function __construct(
        public readonly string $url,
        public readonly string $scheme,
        public readonly string $host,
        public readonly int $port,
        public readonly array $ips,
    ) {
    }
}
