import { VpnClientDoc } from '../db/index.js';
import type { ITargetProfile, ITargetProfileTarget } from '../../dist_ts_interfaces/data/target-profile.js';
import type { IDcRouterRouteConfig } from '../../dist_ts_interfaces/data/remoteingress.js';
import type { IRoute } from '../../dist_ts_interfaces/data/route-management.js';
type TVpnClientAllowEntry = string | {
    clientId: string;
    domains: string[];
};
/**
 * Manages TargetProfiles (target-side: what can be accessed).
 * TargetProfiles define what resources a VPN client can reach:
 * domains, specific IP:port targets, and/or direct route references.
 */
export declare class TargetProfileManager {
    private getAllRoutes?;
    private profiles;
    constructor(getAllRoutes?: (() => Map<string, IRoute>) | undefined);
    initialize(): Promise<void>;
    createProfile(data: {
        name: string;
        description?: string;
        domains?: string[];
        targets?: ITargetProfileTarget[];
        routeRefs?: string[];
        allowRoutesByClientSourceIp?: boolean;
        createdBy: string;
    }): Promise<string>;
    updateProfile(id: string, patch: Partial<Omit<ITargetProfile, 'id' | 'createdAt' | 'createdBy'>>): Promise<void>;
    deleteProfile(id: string, force?: boolean): Promise<{
        success: boolean;
        message?: string;
    }>;
    getProfile(id: string): ITargetProfile | undefined;
    /**
     * Normalize stored route references to route IDs when they can be resolved
     * uniquely against the current route registry.
     */
    normalizeAllRouteRefs(): Promise<void>;
    listProfiles(): ITargetProfile[];
    /**
     * Get which VPN clients reference a target profile.
     */
    getProfileUsage(profileId: string): Promise<Array<{
        clientId: string;
        description?: string;
    }>>;
    /**
     * For a set of target profile IDs, collect all explicit target IPs.
     * These IPs bypass the SmartProxy forceTarget rewrite — VPN clients can
     * connect to them directly through the tunnel.
     */
    getDirectTargetIps(targetProfileIds: string[]): string[];
    /**
     * Find all enabled VPN clients whose assigned TargetProfile matches the route.
     * Returns SmartProxy VPN client allow entries for authenticated metadata checks.
     *
     * Entries are domain-scoped when a profile matches via specific domains that are
     * a subset of the route's wildcard. Plain IPs are returned for routeRef/target matches
     * or when profile domains exactly equal the route's domains. Profiles can also opt
     * into source-policy routes; SmartProxy evaluates the real source IP per connection.
     */
    getMatchingVpnClients(route: IDcRouterRouteConfig, routeId: string | undefined, clients: VpnClientDoc[], allRoutes?: Map<string, IRoute>): TVpnClientAllowEntry[];
    /**
     * For a given client (by its targetProfileIds), compute the set of
     * domains and target IPs it can access. Used for WireGuard AllowedIPs.
     */
    getClientAccessSpec(targetProfileIds: string[], allRoutes: Map<string, IRoute>): {
        domains: string[];
        targetIps: string[];
    };
    /**
     * Check if a route matches a profile (boolean convenience wrapper).
     */
    private routeMatchesProfile;
    /**
     * Detailed match: returns 'full' (plain IP, entire route), 'scoped' (domain-limited),
     * or 'none' (no match).
     *
     * - routeRefs / target matches → 'full' (explicit reference = full access)
     * - domain match where profile domains are a subset of route wildcard → 'scoped'
     * - domain match where domains are identical or profile is a wildcard → 'full'
     */
    private routeMatchesProfileDetailed;
    /**
     * Check if a domain matches a pattern.
     * - '*.example.com' matches 'sub.example.com', 'a.b.example.com'
     * - 'example.com' matches only 'example.com'
     */
    private domainMatchesPattern;
    private routeHasSourcePolicy;
    private getRouteDomains;
    private normalizeRouteRefs;
    private normalizeRouteRefsAgainstRoutes;
    private buildRouteNameIndex;
    private sameStringArray;
    private loadProfiles;
    private persistProfile;
}
export {};