Function resolve_public 

pub async fn resolve_public(
    url: &Url,
    private: PrivateAddresses,
) -> Result<Vec<SocketAddr>, AddressError>

Every address url’s host answers to, refused unless every one of them is public.

Every address, not the first: a name that answers with one public address and one loopback address is a name aimed at this deployment’s own network, whichever one reqwest goes on to pick.

A host that resolves to nothing at all is refused here rather than left to fail in the fetch, so that both outcomes cost the same and a caller can map them to one answer.

The addresses come back so a caller can pin its client to them – see pinned_client, which is the only way a check made here still holds at connect time.