/**
 * Plain-SSH local port forward used by the `db_query` / `get_db_schemas` MCP
 * tools when a DB connection is configured to be reached through a bastion
 * (see `DbCredentials.ssh`). Opens an ssh2 tunnel and a local TCP listener,
 * so mysql2/pg can connect to `127.0.0.1:<localPort>` and have traffic
 * forwarded to the real database host over the SSH channel.
 *
 * Scope: plain SSH only. SSM (P2) and Tailscale are out of scope here; the
 * Tailscale SOCKS5 path lives in `commands/ssh-executor.ts`.
 *
 * Fallback禁止 (see CLAUDE.md): missing/invalid SSH credential material or a
 * failed SSH connect is a hard error — never a silent direct connection.
 *
 * Lifecycle: the caller (`executeQueryWithTunnel`) opens one tunnel per query
 * and always `close()`s it in a `finally`, so the listener/SSH connection do
 * not leak across queries even though the agent process is long-lived.
 *
 * `ssh2` is loaded via dynamic `import()` (mirroring `ssh-executor.ts`) so
 * agents that never query a tunneled DB do not pay its require() cost at
 * startup.
 *
 * SECURITY: `ssh.privateKey` (holds SSH key material or, for password auth, a
 * plaintext password) must never be logged.
 */
import { type SshCredentials } from '../../types';
/** A live SSH local port forward. Connect to `host:port`; call `close()` when done. */
export interface DbTunnel {
    host: string;
    port: number;
    close: () => Promise<void>;
}
/** The remote endpoint a tunnel forwards to. */
export interface TunnelTarget {
    host: string;
    port: number;
}
/**
 * Open a plain SSH tunnel (local port forward) to `target` via the bastion
 * described by `ssh`. Returns the local endpoint to connect to and a `close()`
 * that tears down both the local listener and the SSH connection.
 */
export declare function openSshTunnel(ssh: SshCredentials, target: TunnelTarget): Promise<DbTunnel>;
//# sourceMappingURL=db-tunnel.d.ts.map