import type { IDcRouterRouteConfig, IRemoteIngress, IRemoteIngressEgressPolicyConfig, IRemoteIngressHubSettings, IRemoteIngressPerformanceConfig, TRemoteIngressHubSettingsUpdate } from '../../dist_ts_interfaces/data/remoteingress.js';
/** Operator-declared host identity of an edge (public IPs + PTR-aligned mail hostname). */
export interface IRemoteIngressEdgeHostInfo {
    publicIp?: string;
    publicIpV6?: string;
    mailHostname?: string;
}
export interface IRemoteIngressFirewallConfig {
    blockedIps?: string[];
}
/**
 * Manages CRUD for remote ingress edge registrations.
 * Persists edge configs via smartdata document classes and provides
 * the allowed edges list for the Rust hub.
 */
export declare class RemoteIngressManager {
    private edges;
    private routes;
    private firewallConfig?;
    private hubPublicIps;
    private onEdgesChanged?;
    private hubSettings;
    constructor();
    /**
     * Set the hub's own public IPs. Edge publicIp values equal to any of these
     * are rejected — the hub IP must never become an edge-fronted DNS target.
     */
    setHubPublicIps(ips: Array<string | undefined>): void;
    /**
     * Register a callback fired after every edge mutation (create/update/delete)
     * so dependent state — mail DNS records — can reconcile.
     */
    setOnEdgesChanged(callback: (reason: string) => void): void;
    private notifyEdgesChanged;
    /**
     * Load all edge registrations from the database into memory.
     */
    initialize(): Promise<void>;
    private initializeHubSettings;
    /**
     * Store the current route configs for port derivation.
     */
    setRoutes(routes: IDcRouterRouteConfig[]): void;
    /**
     * Set the full desired firewall snapshot pushed to all edges.
     */
    setFirewallConfig(firewallConfig?: IRemoteIngressFirewallConfig): void;
    getHubSettings(): IRemoteIngressHubSettings;
    getHubPerformanceConfig(): IRemoteIngressPerformanceConfig | undefined;
    updateHubSettings(updates: TRemoteIngressHubSettingsUpdate, updatedBy: string): Promise<IRemoteIngressHubSettings>;
    /**
     * Derive listen ports for an edge from routes tagged with remoteIngress.enabled.
     * When a route specifies edgeFilter, only edges whose id or tags match get that route's ports.
     * When edgeFilter is absent, the route applies to all edges.
     */
    derivePortsForEdge(edgeId: string, edgeTags?: string[]): number[];
    /**
     * Derive UDP listen ports for an edge from routes with transport 'udp' or 'all'.
     * These ports need UDP listeners on the edge (e.g. for QUIC/HTTP3).
     */
    deriveUdpPortsForEdge(edgeId: string, edgeTags?: string[]): number[];
    /**
     * Get the effective listen ports for an edge.
     * Manual ports are always included. Auto-derived ports are added (union) when autoDerivePorts is true.
     */
    getEffectiveListenPorts(edge: IRemoteIngress): number[];
    /**
     * Get the effective UDP listen ports for an edge.
     * Manual UDP ports are always included. Auto-derived UDP ports are added when autoDerivePorts is true.
     */
    getEffectiveListenPortsUdp(edge: IRemoteIngress): number[];
    /**
     * Get manual and derived port breakdown for an edge (used in API responses).
     * Derived ports exclude any ports already present in the manual list.
     */
    getPortBreakdown(edge: IRemoteIngress): {
        manual: number[];
        derived: number[];
    };
    /**
     * Create a new edge registration.
     */
    createEdge(name: string, listenPorts?: number[], tags?: string[], autoDerivePorts?: boolean, performance?: IRemoteIngressPerformanceConfig, egress?: IRemoteIngressEgressPolicyConfig, hostInfo?: IRemoteIngressEdgeHostInfo): Promise<IRemoteIngress>;
    /**
     * Get an edge by ID.
     */
    getEdge(id: string): IRemoteIngress | undefined;
    /**
     * Get all edge registrations.
     */
    getAllEdges(): IRemoteIngress[];
    /**
     * Update an edge registration.
     */
    updateEdge(id: string, updates: {
        name?: string;
        listenPorts?: number[];
        autoDerivePorts?: boolean;
        enabled?: boolean;
        performance?: IRemoteIngressPerformanceConfig;
        egress?: IRemoteIngressEgressPolicyConfig;
        tags?: string[];
        /** null clears the stored value. */
        publicIp?: string | null;
        publicIpV6?: string | null;
        mailHostname?: string | null;
    }): Promise<IRemoteIngress | null>;
    /**
     * Delete an edge registration.
     */
    deleteEdge(id: string): Promise<boolean>;
    /**
     * Regenerate the secret for an edge.
     */
    regenerateSecret(id: string): Promise<string | null>;
    /**
     * Verify an edge's secret using constant-time comparison.
     */
    verifySecret(id: string, secret: string): boolean;
    /**
     * Get the list of allowed edges (enabled only) for the Rust hub.
     * Includes listenPortsUdp when routes with transport 'udp' or 'all' are present.
     */
    getAllowedEdges(): Array<{
        id: string;
        secret: string;
        listenPorts: number[];
        listenPortsUdp?: number[];
        firewallConfig?: IRemoteIngressFirewallConfig;
        performance?: IRemoteIngressPerformanceConfig;
        egress?: IRemoteIngressEgressPolicyConfig;
    }>;
    /**
     * Resolve enabled edges whose id or tags match any entry in the filter
     * (same semantics as route-level edgeFilter in derivePortsForEdge).
     */
    resolveEdgesByFilter(filter: string[]): IRemoteIngress[];
    /** Enabled edges carrying the well-known 'mail' tag. */
    getMailEdges(): IRemoteIngress[];
    private normalizeEdgePublicIp;
    private normalizeMailHostname;
    private normalizeEgressPolicy;
    private normalizeEgressAllowedPorts;
    private normalizeHubSettingsUpdate;
    private normalizePerformanceConfig;
    private toHubSettings;
}