/**
 * TunnelProvider — abstraction over the underlying tunnel implementation.
 *
 * Per spec specs/dev-infrastructure/tunnel-failure-resilience.md Part 1:
 * the TunnelManager is the single owner of the lifecycle state machine,
 * and each backend (cloudflared quick, cloudflared named, localtunnel,
 * bore) implements this interface. The manager treats providers as
 * interchangeable units; trust-tier ordering (Tier 1 vs Tier 2) and the
 * consent gate live in the manager, NOT in the providers themselves.
 *
 * Two tiers:
 *   - Tier 1: automatic, secure. Cloudflare providers. Tried silently.
 *   - Tier 2: consent-gated relays. localtunnel, bore. Never activated
 *     without explicit owner approval recorded against the episode.
 *
 * Every provider's `start()` MUST resolve only after the URL has passed
 * a post-start reachability probe (verified by the manager via the
 * /health endpoint through the public URL). A URL that emits from
 * cloudflared but doesn't actually serve (e.g. localtunnel interstitial,
 * bore.pub down) is NOT counted as `active` — that prevents a false
 * "back online" broadcast for a dead link.
 *
 * The provider does NOT decide retry, fallback, or notification — those
 * are the manager's responsibility. Provider responsibilities are
 * narrowly: spawn the backend, surface the URL, surface a stop handle.
 */
export {};
//# sourceMappingURL=TunnelProvider.js.map