/** Modal/Daytona/Blaxel tunnels serve browserd at `/`, so a cached
 * controller-only session can host-fetch JSON. OpenSandbox's lifecycle proxy
 * prefixes `/v1/sandboxes/<id>/proxy/<port>` and rewrites Authorization; JSON
 * must stay on an exec-capable in-box curl session. OSEP-0011 signed URIs are
 * Authorization-preserving and host-fetch like a native tunnel, but they are
 * not durable cache keys. */
export declare function controllerCacheAllowsHostFetch(url: string): boolean;
export declare function isOpenSandboxSignedControllerUrl(url: string): boolean;
/** Signed Channel B URLs expire. Do not treat a lease-cached signed URI as an
 * infinite controller endpoint. Unsigned native `/` tunnels stay cacheable. */
export declare function controllerCachedUrlIsUsable(url: string, nowMs?: number): boolean;
export declare function shouldPersistControllerDataPlaneUrl(input: {
    backend: string | null | undefined;
    signedEndpoints: boolean;
    url: string;
}): boolean;
/** Prefer a lease-fenced controller endpoint for the idempotent create path.
 * Only a transport-class failure invalidates the cache and provisions once;
 * semantic failures belong to the caller and must never be replayed. */
export declare function withCachedController<C, T>(options: {
    cachedUrl: string | null;
    createCachedClient: (url: string) => C;
    prepareCachedClient?: (client: C) => Promise<void>;
    invalidateCachedUrl: () => Promise<unknown>;
    provisionClient: () => Promise<C>;
    use: (client: C) => Promise<T>;
}): Promise<T>;
export declare function isRetryableControllerTransport(error: unknown): boolean;