/**
 * @celilo/e2e — E2E test infrastructure for Celilo-deployed applications.
 *
 * Provides a simulated internet environment in Docker with:
 * - DNS hierarchy (root → TLD → registrar → recursive resolver)
 * - ACME server (Pebble, simulating Let's Encrypt)
 * - APT cache (speeds up package installs in containers)
 * - Firewall topology (ISP router, main firewall, zone routing)
 * - Target machines (systemd-based containers for deployment)
 *
 * Usage:
 *   import { network } from '@celilo/e2e';
 *
 *   const net = await network()
 *     .dmz({ caddy: '10.226.10.10' })
 *     .app({ myapp: '10.226.20.10' })
 *     .start();
 *
 *   await net.celilo('module deploy myapp');
 *   // ... assertions ...
 *   await net.stop();
 */

// Builder API
export { network, NetworkBuilder } from './network-builder';

// Reconnect to an existing network (for --reuse mode)
export { reconnectNetwork } from './container-manager';

// Progress reporting (emit signals the test runner displays)
export { progress } from './progress';

// Staged-suite mechanism: cascade-skip later stages after a failure OR a
// timeout (celilo#1272)
export { createStageGuard, createStages } from './stages';
export type { StageGuard, Stages } from './stages';

// Block-timing: static cap extraction shared with the e2e-timeout-cap gate
// (scripts/e2e-timeout-cap.test.ts), so the manifest and the runner read
// budgets through one parser
export { declaredBlockCaps, declaredCapEntries, tightBlocks } from './block-timing';
export type { BlockTiming, DeclaredCapEntry, TightBlock } from './block-timing';

// Types
export type {
  NetworkConfig,
  NetworkHandle,
  ExecResult,
  MachineSpec,
  Zone,
  Vantage,
  ObserverSpec,
  TopologyPreset,
  ProxyOptions,
  SocksProxyHandle,
  BrowserOptions,
  BrowserHandle,
  BrowserLauncher,
} from './types';
export {
  CeliloCommandError,
  externalWanIp,
  externalWanSubnet,
  greenwaveRouterIp,
  internalNatIp,
  internalResolverIp,
  publicResolverIp,
  ZONE_GATEWAYS,
  ZONE_SUBNETS,
} from './types';

// Vantage-point network assertions (ISS-0117)
export { VantageProbe, VantageAssertionError } from './vantage';
export type {
  ProbeTransport,
  ResolveMethod,
  ResolveResult,
  HttpsResult,
  CertInfo,
  ResolutionInspection,
  ExpectedZone,
} from './vantage';
export { createObserverTransport, vantageContainer, OBSERVER_PLACEMENTS } from './observer';
export { classifyIp, isSegmentedZoneIp, isPublicLeakSafe } from './zone-classifier';
export type { ZoneClass } from './zone-classifier';
export { assertFrontedServicePositives, assertFrontedHostnames } from './vantage-helpers';
export type { FrontedServiceExpectation } from './vantage-helpers';

// Common fixtures
export {
  CADDY_DEPLOYMENT,
  FULL_STACK,
  INFRASTRUCTURE_ONLY,
  AUTHENTIK_DEPLOYMENT,
  MULTI_DMZ,
  TECHNITIUM_STACK,
  TECHNITIUM_DHCP_STACK,
} from './fixtures';

// Simulator addresses on `internet-external` — canonical for code, so a test
// asserting against the authoritative DNS server never hardcodes its IP.
export { PROXMOX_SIM_IP, SIMULATOR_IPS, SIMULATOR_IP_ENTRIES } from './simulator-ips';
export type { SimulatorIpName } from './simulator-ips';

// Shared infrastructure management (for test runners)
export { ensureSharedInfra, stopSharedInfra, isSharedInfraRunning } from './shared-infra';

// Low-level (for custom compose generation)
export {
  generateSharedInfraYaml,
  generateTestComposeYaml,
  generateComposeYaml,
  SHARED_PROJECT_NAME,
  SHARED_NETWORKS,
} from './docker-compose-generator';

// Runtime router-device swap — the harness half of "the ISP replaced the box"
// (openspec/changes/module-pause-lifecycle task 7.7).
export {
  ROUTER_DEVICES,
  type RouterDevice,
  type RouterSwapResult,
  forwardedPorts,
  listRouterForwards,
  routerDhcpDnsServers,
  swapRouterDevice,
} from './router-swap';