import * as tls from "node:tls";
import type { FetchImpl } from "../types.js";
/**
 * Checks if a host is local or cloud metadata, which should always bypass the proxy
 * (e.g. localhost, 127/8, ::1, 169.254.169.254, metadata.google.internal).
 */
export declare function isLocalOrMetadataHost(host: string): boolean;
/**
 * Check if the url should bypass the proxy due to hard-coded localhost/metadata checks
 * or custom NO_PROXY/no_proxy environment variables rules.
 */
export declare function shouldBypassProxy(urlObj: URL): boolean;
/** Test seam: clears the provider proxy cache. */
export declare function __resetProxyCache(): void;
/**
 * Normalizes provider id (e.g. github-copilot -> PI_PROXY_GITHUB_COPILOT) and looks it up.
 * If not found, falls back to PI_PROXY. Results are memoized because env values are static
 * for the lifetime of the process and this function is called for every outgoing request.
 */
export declare function getProxyForProvider(provider: string): string | undefined;
/**
 * Wraps a fetch implementation to inject proxy options for non-local hosts.
 */
export declare function wrapFetchForProxy(fetchImpl: FetchImpl, provider: string): FetchImpl;
export interface ConnectProxiedSocketOptions {
    /** Caller cancellation for the proxy TCP/TLS handshake and CONNECT tunnel. */
    signal?: AbortSignal;
    /** Maximum wall-clock time to establish the final TLS tunnel. Disabled when absent or non-positive. */
    timeoutMs?: number;
}
/**
 * Tunnel a socket connection through an HTTP CONNECT proxy.
 * This is used specifically to wrap Node's `http2.connect(baseUrl, { createConnection })` for Cursor.
 */
export declare function connectProxiedSocket(proxyUrlStr: string, targetUrlStr: string, options?: ConnectProxiedSocketOptions): Promise<tls.TLSSocket>;