/**
 * Gateway — the single point of network control.
 *
 * One HTTP server that does three things:
 *   1. Mock LLM API  — POST to Anthropic/OpenAI/Google endpoints → brain function
 *   2. HTTP forward proxy  — GET http://host/... → allow, block, or intercept
 *   3. HTTPS tunnel proxy  — CONNECT host:443   → allow or block
 *
 * All LLM providers are redirected here via models.json base URL overrides.
 * No MITM, no fake certs. Simple HTTP to the gateway.
 *
 * The sandbox can ONLY reach this server (iptables).
 * So the gateway IS the internet as far as the sandbox is concerned.
 */
import { type IncomingMessage, type ServerResponse } from "node:http";
import { type Brain, type ApiRequest } from "./anthropic.js";
import { type ProviderName } from "./providers.js";
export type NetworkAction = "allow" | "block" | "intercept";
export interface InterceptResponse {
    /** HTTP status code. Default: 200 */
    status?: number;
    /** Response headers. */
    headers?: Record<string, string>;
    /** Response body. */
    body: string;
}
export type InterceptHandler = (host: string, method: string, path: string, headers: Record<string, string>) => InterceptResponse | Promise<InterceptResponse>;
export interface NetworkRule {
    match: string | RegExp;
    action?: NetworkAction;
    response?: InterceptResponse;
    handler?: InterceptHandler;
}
export interface ProxyLogEntry {
    host: string;
    method: string;
    url?: string;
    action: NetworkAction;
    provider?: ProviderName;
    ts: number;
}
export interface GatewayConfig {
    brain: Brain;
    rules?: NetworkRule[];
    default?: NetworkAction;
    port?: number;
    /** Bind address. Default: "127.0.0.1". Use "0.0.0.0" for Docker sandbox access. */
    host?: string;
    onManagement?: (req: IncomingMessage, res: ServerResponse) => Promise<void> | void;
}
export interface Gateway {
    readonly url: string;
    readonly port: number;
    readonly requests: ApiRequest[];
    readonly proxyLog: ProxyLogEntry[];
    setBrain(brain: Brain): void;
    setRules(rules: NetworkRule[], defaultAction?: NetworkAction): void;
    /** Subscribe to brain requests. Returns unsubscribe. */
    onRequest(listener: (req: ApiRequest, index: number) => void): () => void;
    close(): Promise<void>;
}
export declare function createGateway(config: GatewayConfig): Promise<Gateway>;
//# sourceMappingURL=gateway.d.ts.map