/**
 * LocaltunnelProvider — Tier-2 consent-gated relay tunnel via *.loca.lt.
 *
 * Per spec specs/dev-infrastructure/tunnel-failure-resilience.md Part 1
 * (provider abstraction, Tier 2) and Part 7 (supply-chain hardening).
 *
 * SECURITY POSTURE:
 *   - localtunnel routes the agent's local server traffic through
 *     loca.lt servers. The relay operator (and anyone who logs the URL)
 *     can see dashboard PIN + signed view URLs while the relay is active.
 *     This is exactly why the spec gates Tier-2 providers behind owner
 *     consent — see Part 3 (consent flow) and Part 6 (mandatory
 *     credential rotation on relay-episode end).
 *   - The agent never spins this up without an explicit per-episode
 *     consent record bound to the owner principal — that's enforced in
 *     TunnelManager's state machine, not in this provider.
 *
 * Supply-chain hardening (Part 7):
 *   - The npm package `localtunnel` is pinned at exact version in
 *     package.json (no caret range).
 *   - The provider spawns the localtunnel client via its programmatic
 *     API; a future hardening PR can switch to child-process isolation
 *     once the spec's checksum-verified install path is added.
 *   - `isAvailable()` resolves false if the npm package cannot be
 *     loaded, so a missing dep degrades gracefully (provider skipped)
 *     instead of crashing.
 *
 * The provider does NOT own retry/reconnect/notification — those are
 * the manager's responsibility per the single-owner mandate (PR 2).
 */
import type { TunnelProvider, TunnelProviderHandle, ProviderName, ProviderTier } from './TunnelProvider.js';
export interface LocaltunnelProviderOptions {
    /** Local port the relay should point at. */
    port: number;
    /** Start timeout in milliseconds (default: 20_000). */
    startTimeoutMs?: number;
    /**
     * Optional subdomain hint passed to localtunnel. When set, the
     * service will try to allocate the requested name; when unavailable
     * (already taken or rate-limited), localtunnel falls back to a
     * random subdomain. NEVER use the agent's identity here — the
     * subdomain is publicly visible on *.loca.lt.
     */
    subdomain?: string;
}
export declare class LocaltunnelProvider implements TunnelProvider {
    readonly name: ProviderName;
    readonly tier: ProviderTier;
    private readonly port;
    private readonly startTimeoutMs;
    private readonly subdomain;
    /**
     * Cached dynamic-import result. The first `isAvailable()` call
     * detects whether the npm package is present; subsequent calls reuse
     * the cached resolution.
     */
    private _moduleResolved;
    constructor(opts: LocaltunnelProviderOptions);
    isAvailable(): Promise<boolean>;
    start(localPort: number): Promise<TunnelProviderHandle>;
    private loadModule;
}
//# sourceMappingURL=LocaltunnelProvider.d.ts.map