/**
 * The CONNECT proxy warp puts in front of the child process.
 *
 * Ported from wardex proxy.go, with two deliberate narrowings:
 *
 *  - wardex decrypts every host once --mitm is on; warp decrypts only hosts a
 *    route could match and blindly tunnels the rest. Under warp the agent
 *    believes it is talking straight to api.anthropic.com, so the less we
 *    terminate, the fewer ways that belief can break.
 *  - wardex owns its listener; warp attaches to the proxy server pxpipe is
 *    already running. CONNECT is a distinct event from a normal request, so one
 *    port serves both the origin-form traffic pxpipe handles and the
 *    absolute-form/CONNECT traffic a forward proxy handles.
 */
import type { IncomingMessage, ServerResponse } from 'node:http';
import { type Socket } from 'node:net';
import type { CertificateAuthority } from './ca.js';
import { type Route } from './route.js';
export interface WarpHandlerOptions {
    routes: readonly Route[];
    ca: CertificateAuthority;
    /** Called the first time each route diverts a request, for the log. */
    onDivert?: (host: string, path: string, target: string) => void;
}
export interface WarpHandlers {
    /** Attach as the server's 'connect' listener. */
    handleConnect: (req: IncomingMessage, socket: Socket, head: Buffer) => void;
    /** Call from the request handler for absolute-form request targets. */
    handleAbsoluteForm: (req: IncomingMessage, res: ServerResponse) => void;
}
export declare function createWarpHandlers(options: WarpHandlerOptions): WarpHandlers;
//# sourceMappingURL=connect.d.ts.map