/**
 * Cloud messaging endpoints — the one gate every agent-messaging network call
 * passes through (T13169).
 *
 * SignalDock (`api.signaldock.io`) is retired (owner decision D008), and its
 * servers are being deleted. Agent rows registered before the retirement
 * still carry its URL: the `api_base_url` column defaults to it, and CLEO
 * never rebuilds a table to change a default. So CLEO does not trust the
 * stored URL. Every call to an agent's cloud API goes through
 * {@link conduitFetch}, which refuses a SignalDock host before any network
 * I/O, at every redirect hop, and the transports refuse one when they connect.
 * As a backstop for any other path, {@link installRetiredHostFetchGuard}
 * wraps the process-global `fetch`. Only the CLI installs it, before every
 * command; SDK consumers of core and runtime are unaffected.
 *
 * `EventSource` follows redirects internally and cannot be checked per hop.
 * It is not a global in Node 24 without `--experimental-eventsource`, so the
 * SSE transport falls back to HTTP polling through {@link conduitFetch}.
 *
 * @task T13169
 */
/** Hosts of the retired SignalDock service. A subdomain of one is retired too. */
export declare const RETIRED_CLOUD_HOSTS: readonly string[];
/** Error code for a refused call to a retired cloud host. */
export declare const E_SIGNALDOCK_RETIRED = "E_SIGNALDOCK_RETIRED";
/**
 * The host of `url` when it is a retired SignalDock host, else `null`.
 *
 * A string that does not parse as a URL is not retired here: `fetch` and
 * `EventSource` cannot open it either.
 *
 * @param url - A base URL or full request URL, as stored or configured.
 * @returns The retired host name, or `null`.
 */
export declare function retiredCloudHost(url: string | null | undefined): string | null;
/**
 * Whether `url` points at a retired SignalDock host.
 *
 * @param url - A base URL or full request URL.
 * @returns `true` when CLEO must not call it.
 */
export declare function isRetiredCloudUrl(url: string | null | undefined): boolean;
/** A call to a retired cloud host was refused before any network I/O. */
export declare class SignalDockRetiredError extends Error {
    /** Stable error code, {@link E_SIGNALDOCK_RETIRED}. */
    readonly code = "E_SIGNALDOCK_RETIRED";
    /** The refused host. */
    readonly host: string;
    /**
     * @param host - The retired host that was refused.
     */
    constructor(host: string);
}
/**
 * Whether `err` is a {@link SignalDockRetiredError}.
 *
 * @param err - A caught value.
 * @returns `true` when the call was refused because its host is retired.
 */
export declare function isSignalDockRetiredError(err: unknown): err is SignalDockRetiredError;
/**
 * Throw {@link SignalDockRetiredError} when `url` points at a retired host.
 *
 * @param url - The URL about to be opened.
 * @throws {SignalDockRetiredError} When the host is retired.
 */
export declare function assertCloudUrlAllowed(url: string | null | undefined): void;
/** Redirect hops {@link conduitFetch} follows before giving up. */
export declare const MAX_CONDUIT_REDIRECTS = 5;
/**
 * `fetch` for an agent's cloud messaging API. It refuses a retired host
 * before any network I/O, and follows redirects itself so that every hop's
 * host is checked too.
 *
 * Redirects follow the fetch standard: a 303, or a 301/302 after a POST,
 * becomes a body-less GET, and `Authorization`, `Cookie` and
 * `Proxy-Authorization` are dropped when the origin changes. A caller that
 * sets `redirect: 'manual'` or `'error'` gets fetch's own behaviour after the
 * first check.
 *
 * @param url - The full request URL.
 * @param init - The request options, passed through.
 * @returns The response.
 * @throws {SignalDockRetiredError} When the URL, or any redirect target, is a retired host.
 */
export declare function conduitFetch(url: string, init?: RequestInit): Promise<Response>;
/**
 * Wrap the process-global `fetch` so that any request to a retired SignalDock
 * host is refused, whichever code path makes it. Every other request passes
 * through unchanged. Calling it again is a no-op.
 *
 * This is the backstop behind {@link conduitFetch}: it checks the first URL
 * only (redirect hops are checked by {@link conduitFetch}).
 */
export declare function installRetiredHostFetchGuard(): void;
//# sourceMappingURL=cloud-endpoint.d.ts.map