export interface DeploymentConnectivityIntent {
    private?: {
        mode: 'disabled' | 'private-lan';
    } | {
        mode: 'cloudflare-warp';
        credential: string;
        network: string;
    };
    public?: {
        mode: 'disabled';
    } | {
        mode: 'cloudflare-tunnel';
        credential: string;
        hostname: string;
        tunnelKey: string;
        service: {
            protocol: 'http';
            port: number;
        };
    };
}
/** Connector-scoped capabilities delivered only inside the hybrid-sealed node claim. */
export interface DeploymentConnectivityCapabilities {
    public?: {
        tunnelId: string;
        connectorToken: string;
    };
    private?: {
        connectorId: string;
        connectorToken: string;
        siteRouteId: string;
    };
}
export interface DeploymentConnectivityTopology {
    site: string;
    nodeIdentity: string;
    siteCidr: string;
    role: 'relay' | 'standby' | 'member';
    transport: 'private-lan' | 'cloudflare-warp';
    localRelayAddress: string;
    localPeerAddresses: readonly string[];
    localPeerIdentities: readonly string[];
    remoteRelayAddresses: readonly string[];
    remoteRelayIdentities: readonly string[];
    remoteMemberAddresses: readonly string[];
    remoteSiteCidrs: readonly string[];
    memberIdentities: readonly string[];
    healthPort: number;
    routedTcpPorts: readonly number[];
    generation: string;
}
export interface DeploymentFirewallRule {
    ruleKey: string;
    action: 'allow' | 'deny';
    protocol: 'tcp' | 'udp';
    sourceAddresses: readonly string[];
    portFrom: number;
    portTo: number;
    priority: number;
}
/** API-compiled, exact-address policy. Names and selectors never reach the host. */
export interface DeploymentFirewallPolicy {
    generation: `sha256:${string}`;
    rules: readonly DeploymentFirewallRule[];
}
export interface DeploymentConnectivityRequest {
    key: string;
    intent: DeploymentConnectivityIntent;
    capabilities: DeploymentConnectivityCapabilities;
    topology?: DeploymentConnectivityTopology;
    firewallPolicy?: DeploymentFirewallPolicy;
}
export interface DeploymentConnectivityEvidence {
    key: string;
    public?: {
        hostname: string;
        tunnelId: string;
        unit: string;
        active: true;
    };
    private?: {
        network: string;
        connectorId: string;
        unit: string;
        active: true;
    };
    topology?: {
        site: string;
        siteCidr: string;
        role: DeploymentConnectivityTopology['role'];
        probed: string[];
    };
    firewall?: {
        generation: string;
        rules: number;
        active: true;
    };
}
export interface DeploymentConnectivityHost {
    seal(name: string, path: string, value: string): Promise<void>;
    write(path: string, content: string, mode: number): void;
    exec(argv: readonly string[]): Promise<{
        exitCode: number;
        output: string;
    }>;
    probe(address: string, port: number, timeoutMs: number): Promise<boolean>;
    sleep(ms: number): Promise<void>;
}
/** Apply only connector-scoped capabilities; the broad Cloudflare token never reaches this helper. */
export declare function applyDeploymentConnectivity(request: DeploymentConnectivityRequest, host?: DeploymentConnectivityHost): Promise<DeploymentConnectivityEvidence>;