export declare const AGENT_EGRESS_TABLE = "forgezero_agent_egress";
export declare const SYSTEMD_RESOLVED_STUB = "/run/systemd/resolve/stub-resolv.conf";
export declare const SYSTEMD_RESOLVED_ADDRESS = "127.0.0.53";
export declare const BLOCKED_IPV4: readonly ["0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "168.63.129.16/32", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.2.0/24", "192.88.99.0/24", "192.168.0.0/16", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4"];
export declare const BLOCKED_IPV6: readonly ["::/128", "::1/128", "::ffff:0:0/96", "64:ff9b::/96", "64:ff9b:1::/48", "100::/64", "fc00::/7", "fec0::/10", "fe80::/10", "ff00::/8", "2001::/32", "2001:2::/48", "2001:10::/28", "2001:20::/28", "2001:db8::/32", "2002::/16", "3fff::/20"];
export declare const normalizeEgressTcpPorts: (ports: readonly number[]) => readonly number[];
export interface LoopbackEgressGrant {
    uid: number;
    tcpPorts: readonly number[];
    /** Exact loopback ports available to every protected service UID. */
    sharedTcpPorts?: readonly number[];
    /** When present, reject every other public protocol/port for this UID. */
    publicTcpPorts?: readonly number[];
}
/** Native cgroup filtering stays active even if an operator later reloads nftables. */
export declare function systemdAgentEgressDirectives(loopbackTcpPorts?: readonly number[]): string;
/** One atomic nftables transaction installed before systemd marks the policy ready. */
export declare function renderAgentEgressNft(uids: readonly number[], replace?: boolean, loopback?: LoopbackEgressGrant): string;
export interface EgressCommandResult {
    exitCode: number;
    stdout: string;
    stderr: string;
}
export type EgressCommand = (argv: readonly string[], stdin?: string) => EgressCommandResult;
export declare function resolveServiceUid(user: string, command?: EgressCommand): number;
export declare function assertResolvedStub(realpath?: (path: string) => string): void;
export declare function verifyAgentEgressPolicy(uids: readonly number[], command?: EgressCommand, loopback?: LoopbackEgressGrant): boolean;
export declare function applyAgentEgressPolicy(options: {
    users: readonly string[];
    loopback?: {
        user: string;
        tcpPorts: readonly number[];
        sharedTcpPorts?: readonly number[];
        publicTcpPorts?: readonly number[];
    };
    command?: EgressCommand;
    realpath?: (path: string) => string;
    getuid?: () => number;
}): readonly number[];
export declare function superviseAgentEgressPolicy(options: {
    users: readonly string[];
    loopback?: {
        user: string;
        tcpPorts: readonly number[];
        sharedTcpPorts?: readonly number[];
        publicTcpPorts?: readonly number[];
    };
    command?: EgressCommand;
    realpath?: (path: string) => string;
    getuid?: () => number;
    intervalMs?: number;
    notifyReady?: () => void;
    wait?: (milliseconds: number) => Promise<void>;
}): Promise<never>;