/**
 * Bug-Box Network Isolation
 *
 * Provides three strategies to prevent a replayed command from accessing the network:
 *
 *   - unshare (Linux):      wraps the command in `unshare --net`, creating a new
 *                            network namespace with only a loopback interface.
 *   - sandbox-exec (macOS): wraps the command in `sandbox-exec -p '(deny network*)'`.
 *   - netsh (Windows):      creates a temporary Windows Firewall rule before the
 *                            process starts and removes it after the process exits.
 *                            This is a pre/post approach, not a command wrapper.
 *   - none:                 no network isolation. Used when no primitive is available,
 *                            or when the user explicitly opts out.
 *
 * Design:
 *   selectNetworkStrategy()       — picks the best strategy for the current platform.
 *   buildNetworkIsolationArgs()   — transforms the command array (wrapping if needed).
 *   createNetworkCleanup()        — returns a cleanup function for post-exec teardown.
 */
import { PlatformCapabilities } from './capabilities';
/** The isolation approach selected for this platform. */
export type NetworkStrategy = 'unshare' | 'netsh' | 'sandbox-exec' | 'none';
/** Result of command transformation for network isolation. */
export interface NetworkIsolationResult {
    /** The (possibly wrapped) command array to spawn. */
    command: string[];
    /** If true, the caller must run pre-exec setup (e.g. netsh rule) before spawn. */
    needsPreExec: boolean;
    /** The strategy that was applied. */
    strategy: NetworkStrategy;
}
/**
 * Selects the best available network isolation strategy for the given platform.
 */
export declare function selectNetworkStrategy(caps: PlatformCapabilities): NetworkStrategy;
/**
 * Transforms a command array to include network isolation, if the strategy
 * supports command wrapping (unshare, sandbox-exec).
 *
 * For `netsh`, the command is returned unchanged because netsh uses firewall
 * rules applied before/after the process, not a wrapper.
 *
 * For `none`, the command is returned unchanged.
 */
export declare function buildNetworkIsolationArgs(strategy: NetworkStrategy, command: string[]): NetworkIsolationResult;
/**
 * Creates a cleanup function that removes any network isolation artifacts
 * after the replayed process exits.
 *
 * - unshare / sandbox-exec: the kernel automatically tears down the namespace
 *   or sandbox when the process exits. Cleanup is a no-op.
 * - netsh: removes the temporary firewall rule by name.
 * - none: no-op.
 *
 * @param strategy  The isolation strategy that was applied.
 * @param ruleName  (netsh only) The firewall rule name to remove.
 */
export declare function createNetworkCleanup(strategy: NetworkStrategy, ruleName?: string): () => void;
/**
 * Adds a Windows Firewall rule that blocks all outbound traffic for a process.
 * Called as pre-exec for the `netsh` strategy.
 *
 * @param ruleName  Unique rule name for later cleanup.
 * @param exePath   Path to the executable to block.
 * @returns true if the rule was added, false on failure.
 */
export declare function addFirewallBlockRule(ruleName: string, exePath: string): boolean;
//# sourceMappingURL=network.d.ts.map