/**
 * local-network — hub-only singleton.
 *
 * Enumerates the host's network interfaces and ranks them so that:
 *
 *  • Addons that need a "where do we listen / point a tunnel at" answer
 *    (cloudflare-tunnel, ngrok, RTSP restream, cluster join URL, TLS
 *    cert SAN) consume `getPreferred()` instead of hard-coding
 *    `localhost`. Critical for docker-sidecar setups where the addon
 *    process needs the container's eth0 (not 127.0.0.1).
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
 *    on connect — LAN IPv4 first (lowest latency when on same network),
 *    then public hostname (if a tunnel is up), then IPv6. The SDK can
 *    race them with short timeouts and stick with the winner for the
 *    session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
 * via the same surface would leak internal topology with no upside.
 *
 * Implementation in `@camstack/core/builtins/local-network/`.
 */
import { z } from 'zod';
import { type InferProvider } from './capability-definition.js';
declare const LocalInterfaceSchema: z.ZodObject<{
    name: z.ZodString;
    family: z.ZodEnum<{
        IPv4: "IPv4";
        IPv6: "IPv6";
    }>;
    address: z.ZodString;
    cidr: z.ZodString;
    netmask: z.ZodString;
    internal: z.ZodBoolean;
    mac: z.ZodString;
    kind: z.ZodEnum<{
        other: "other";
        lan: "lan";
        vpn: "vpn";
        wifi: "wifi";
        docker: "docker";
        loopback: "loopback";
    }>;
    preferred: z.ZodBoolean;
    plausible: z.ZodBoolean;
    plausibleReason: z.ZodString;
}, z.core.$strip>;
/**
 * Candidate base URL for the SDK to race on connect. Order matters —
 * the SDK should attempt these top-to-bottom with a short per-candidate
 * timeout (e.g. 1500ms) and cache the winner for the session.
 */
declare const ConnectionEndpointSchema: z.ZodObject<{
    label: z.ZodString;
    baseUrl: z.ZodString;
    kind: z.ZodEnum<{
        public: "public";
        loopback: "loopback";
        "lan-ipv4": "lan-ipv4";
        "lan-ipv6": "lan-ipv6";
    }>;
    interfaceKind: z.ZodEnum<{
        public: "public";
        other: "other";
        lan: "lan";
        vpn: "vpn";
        wifi: "wifi";
        docker: "docker";
        loopback: "loopback";
    }>;
    plausible: z.ZodBoolean;
    plausibleReason: z.ZodString;
    priority: z.ZodNumber;
}, z.core.$strip>;
export declare const localNetworkCapability: {
    readonly name: "local-network";
    readonly scope: "system";
    readonly mode: "singleton";
    readonly methods: {
        /** Return the current interface snapshot. */
        readonly list: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
            interfaces: z.ZodReadonly<z.ZodArray<z.ZodObject<{
                name: z.ZodString;
                family: z.ZodEnum<{
                    IPv4: "IPv4";
                    IPv6: "IPv6";
                }>;
                address: z.ZodString;
                cidr: z.ZodString;
                netmask: z.ZodString;
                internal: z.ZodBoolean;
                mac: z.ZodString;
                kind: z.ZodEnum<{
                    other: "other";
                    lan: "lan";
                    vpn: "vpn";
                    wifi: "wifi";
                    docker: "docker";
                    loopback: "loopback";
                }>;
                preferred: z.ZodBoolean;
                plausible: z.ZodBoolean;
                plausibleReason: z.ZodString;
            }, z.core.$strip>>>;
            probedAt: z.ZodNumber;
        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
        /**
         * Auto-selected outbound interface. Heuristic:
         *   1. Skip internal / link-local / 169.254.*.
         *   2. Prefer LAN/wifi (real Ethernet) over docker/vpn.
         *   3. IPv4 wins over IPv6 (compat with legacy consumers).
         *   4. Tie-break on lowest CIDR mask (most-specific subnet).
         * Returns `null` only when the host has zero non-loopback addresses.
         * Honours `getAllowedAddresses()` — if the operator pinned an
         * allowlist, only those addresses are candidates.
         */
        readonly getPreferred: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodNullable<z.ZodObject<{
            name: z.ZodString;
            family: z.ZodEnum<{
                IPv4: "IPv4";
                IPv6: "IPv6";
            }>;
            address: z.ZodString;
            cidr: z.ZodString;
            netmask: z.ZodString;
            internal: z.ZodBoolean;
            mac: z.ZodString;
            kind: z.ZodEnum<{
                other: "other";
                lan: "lan";
                vpn: "vpn";
                wifi: "wifi";
                docker: "docker";
                loopback: "loopback";
            }>;
            preferred: z.ZodBoolean;
            plausible: z.ZodBoolean;
            plausibleReason: z.ZodString;
        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
        /**
         * Ordered candidate base URLs the SDK should try on connect.
         * Includes LAN IPs (one per non-internal interface), the public
         * tunnel hostname (when active), and loopback as a last-resort
         * fallback. Filterable by `includeLoopback` / `ipv4Only`.
         * Honours `getAllowedAddresses()` when set — addresses outside
         * the allowlist are dropped (the public tunnel + loopback are
         * always included as escape hatches).
         */
        readonly getConnectionEndpoints: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            port: z.ZodNumber;
            includeLoopback: z.ZodOptional<z.ZodBoolean>;
            ipv4Only: z.ZodOptional<z.ZodBoolean>;
            scheme: z.ZodOptional<z.ZodEnum<{
                http: "http";
                https: "https";
            }>>;
        }, z.core.$strip>, z.ZodObject<{
            endpoints: z.ZodReadonly<z.ZodArray<z.ZodObject<{
                label: z.ZodString;
                baseUrl: z.ZodString;
                kind: z.ZodEnum<{
                    public: "public";
                    loopback: "loopback";
                    "lan-ipv4": "lan-ipv4";
                    "lan-ipv6": "lan-ipv6";
                }>;
                interfaceKind: z.ZodEnum<{
                    public: "public";
                    other: "other";
                    lan: "lan";
                    vpn: "vpn";
                    wifi: "wifi";
                    docker: "docker";
                    loopback: "loopback";
                }>;
                plausible: z.ZodBoolean;
                plausibleReason: z.ZodString;
                priority: z.ZodNumber;
            }, z.core.$strip>>>;
        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
        /**
         * Read the operator's allowlist. Empty = "auto" (no filter). Used
         * by the admin UI's address selector to seed its checkbox state.
         */
        readonly getAllowedAddresses: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
            addresses: z.ZodReadonly<z.ZodArray<z.ZodString>>;
        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
        /**
         * Replace the allowlist atomically. Persisted via the addon store
         * (kernel-managed) so it survives restarts. Pass `[]` to revert to
         * auto mode.
         */
        readonly setAllowedAddresses: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            addresses: z.ZodReadonly<z.ZodArray<z.ZodString>>;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
        /**
         * Re-run the boot heuristic over the current interface snapshot
         * and atomically replace the allowlist with the result. Useful
         * after a major network change (new dock, new VPN, IP rebound)
         * when the operator wants to wipe their manual edits and start
         * over from the auto-detected best matches.
         */
        readonly resetAllowlistToBestMatch: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
            addresses: z.ZodReadonly<z.ZodArray<z.ZodString>>;
        }, z.core.$strip>, "mutation">;
    };
};
export type ILocalNetworkProvider = InferProvider<typeof localNetworkCapability>;
export type LocalInterface = z.infer<typeof LocalInterfaceSchema>;
export type ConnectionEndpoint = z.infer<typeof ConnectionEndpointSchema>;
export {};
//# sourceMappingURL=local-network.cap.d.ts.map