import type { JsonValue } from '../types.ts';
/**
 * A workspace's `network`: true for no limit, false for none at all, or the
 * hosts and ranges it may and may not reach and where a connection goes
 * instead, `{ allowed_domains: [...], denied_domains: [...], routes: {...} }`.
 * Mirrors Python's `NetworkSetting`.
 */
export type NetworkSetting = boolean | {
    readonly allowed_domains?: readonly string[];
    readonly denied_domains?: readonly string[];
    readonly routes?: Readonly<Record<string, string>>;
};
/**
 * Whether a workspace may open one connection: its `network` setting, the
 * process's ceiling and the metadata block, each a layer mirage-rs compiles
 * once and every connection must clear. Throws when an entry is not an
 * address, a range or a host name. Mirrors Python's `NetworkRule`.
 */
export declare class NetworkRule {
    readonly layers: readonly Record<string, JsonValue>[];
    readonly metadata: boolean;
    readonly routes: Readonly<Record<string, string>>;
    private readonly stream;
    private readonly targets;
    constructor(layers: readonly Record<string, JsonValue>[], metadata?: boolean, routes?: Readonly<Record<string, string>>);
    /**
     * Where a connection to `host` on `port` goes instead: the host and the
     * port its route names, null for none.
     */
    route(host: string, port: number): readonly [string, number] | null;
    /**
     * Whether a connection to `address`, resolved for `host`, opens on `port`;
     * either name is empty and the port undefined when unknown.
     */
    lets(host: string, address: string, port?: number): boolean;
}
/**
 * The layer a `network` setting adds: none for true or routes alone, one
 * that lets nothing for false, and its allowed and denied lists for an
 * object. Throws for anything else. Mirrors Python's `network_layer`.
 */
export declare function networkLayer(setting: unknown): Record<string, JsonValue> | null;
/**
 * The routes a `network` setting names, `{ "host:port": "host:port" }`;
 * none for true or false. Mirrors Python's `network_routes`.
 */
export declare function networkRoutes(setting: NetworkSetting): Readonly<Record<string, string>>;
/**
 * `base`'s routes with `over`'s in place of any naming the same end, as a
 * session's profile routes over its workspace's. Mirrors Python's
 * `merge_routes`.
 */
export declare function mergeRoutes(base: Readonly<Record<string, string>>, over: Readonly<Record<string, string>>): Record<string, string>;
/**
 * `base` held also to `setting`: its layer added and its routes over the
 * base's; `base` itself when the setting adds neither. Mirrors Python's
 * `narrowed`, which also starts watching; a TypeScript host watches where
 * it binds the rule.
 */
export declare function narrowed(base: NetworkRule | null, setting: NetworkSetting): NetworkRule | null;
/**
 * Whether two settings hold the same rule: their allowed and denied lists
 * name the same entries as written, in any order, `false` being an empty
 * allowed list and an empty denied list none at all, since it refuses
 * nothing, and their routes go from and to the same ends. An entry is
 * compared as written, since one spelling can be an address and another a
 * host name.
 */
export declare function sameNetwork(a: NetworkSetting, b: NetworkSetting): boolean;
/**
 * The rule a workspace's connections are judged by: its `network`, with the
 * cloud metadata addresses refused when `metadata` is set; null when nothing
 * limits or routes it. Mirrors Python's `network_rule`.
 */
export declare function networkRule(setting?: NetworkSetting, metadata?: boolean): NetworkRule | null;
/**
 * `fn` run under a workspace's network rule, which every connection it opens
 * must clear. Mirrors Python's `run_with_network`.
 */
export declare function runWithNetwork<T>(bound: NetworkRule | null, fn: () => Promise<T>): Promise<T>;
/**
 * Whether the workspace a call runs for may open a connection to `address`,
 * resolved for `host`, on `port`. A browser cannot tell one task's binding
 * from another's, so there every live workspace's rule must let it. Mirrors
 * Python's `network_lets`.
 */
export declare function networkLets(host: string, address: string, port?: number): boolean;
/**
 * Where the workspace a call runs for sends a connection to `host` on
 * `port` instead, null for nowhere else. A browser answers by the newest
 * live rule; its page hooks ask each live workspace. Mirrors Python's
 * `network_route`.
 */
export declare function networkRoute(host: string, port: number): readonly [string, number] | null;
/**
 * The rule bound to the running call, null for none, which a watcher reads
 * to skip the rest and keys its pools by. A browser answers the newest live
 * one. Mirrors Python's `network_bound`.
 */
export declare function networkBound(): NetworkRule | null;
//# sourceMappingURL=network.d.ts.map