/**
 * Proxy lifecycle manager.
 *
 * The only stateful piece of the sandbox: holds the long-lived
 * HTTP + SOCKS5 proxy servers and their Unix socket paths.
 *
 * Config resolution and command wrapping are pure functions —
 * the caller composes them with the proxy handle.
 */
interface ProxyCallbacks {
    /** Called when an unknown domain is requested. Return 'once' | 'always' | false. */
    onDomainCheck: (domain: string) => Promise<'once' | 'always' | false>;
}
export declare class ProxyManager {
    private handle;
    private startup;
    private configKey;
    /** Socket paths for the current proxy (undefined if not started). */
    get httpSocketPath(): string | undefined;
    get socksSocketPath(): string | undefined;
    /**
     * Start the network proxy. Reuses the existing proxy when the effective
     * config is unchanged, otherwise restarts it with the new config.
     */
    start(distro: string, allowedDomains: string[], callbacks: ProxyCallbacks): Promise<void>;
    private _start;
    /**
     * Wait for the proxy to be ready.
     * If the proxy was never started, resolves immediately.
     * If the proxy failed to start, resolves (caller should have
     * handled the error via the start() promise and fallen back).
     */
    ensureReady(): Promise<void>;
    /** Stop all proxy servers and bridges. */
    stop(): void;
}
export {};
//# sourceMappingURL=manager.d.ts.map