import * as net from 'net';
import WebSocket from 'ws';
import type { OpenStreamFrame } from './protocol.js';
/**
 * This client is outbound-only: the server cannot dial in. So when the server wants a TCP
 * connection to something on THIS machine, it asks over the control socket, and we open a new
 * outbound WebSocket back — one per connection, carrying raw bytes only.
 *
 * The callback reuses the control socket's URL and token, changing only the path: whatever route,
 * tunnel and credential already work for the control socket work here by construction.
 */
export declare function isOpenStream(msg: unknown): msg is OpenStreamFrame;
export declare function isAllowedTarget(host: string, port: number): boolean;
/** `wss://host/path` → `wss://host/reverse?stream=<id>`; the control URL decides scheme and host. */
export declare function callbackUrl(controlUrl: string, streamId: string): string;
export interface ReverseStreamDeps {
    controlUrl: string;
    headers?: Record<string, string>;
    /** Injectable for tests. */
    connectWs?: (url: string, headers?: Record<string, string>) => WebSocket;
    connectTcp?: (host: string, port: number) => net.Socket;
}
/**
 * Serve one open-stream request. Errors are logged and the sockets closed: a failed stream must
 * never take the control connection down with it, because that would disconnect the whole device.
 */
export declare function openReverseStream(msg: OpenStreamFrame, deps: ReverseStreamDeps): void;