import * as plugins from '../plugins.js';
import type { IRemoteIngressPerformanceConfig, IRemoteIngressStatus } from '../../dist_ts_interfaces/data/remoteingress.js';
import type { IEmailOutboundEgressStatus } from '../../dist_ts_interfaces/data/email-settings.js';
import type { RemoteIngressManager } from './classes.remoteingress-manager.js';
export interface ITunnelManagerConfig {
    tunnelPort?: number;
    targetHost?: string;
    tls?: {
        certPem?: string;
        keyPem?: string;
    };
    performance?: IRemoteIngressPerformanceConfig;
}
export type TRemoteIngressEgressProxyRequest = Omit<plugins.remoteingress.IEgressTcpProxyRequest, 'edgeId'> & {
    edgeId?: string;
    /** Restrict selection to edges whose id or tags match any entry. */
    edgeFilter?: string[];
};
export type TRemoteIngressHubStatus = Awaited<ReturnType<InstanceType<typeof plugins.remoteingress.RemoteIngressHub>['getStatus']>>;
/**
 * Manages the RemoteIngressHub instance and tracks connected edge statuses.
 */
export declare class TunnelManager {
    private hub;
    private manager;
    private config;
    private edgeStatuses;
    private reconcileInterval;
    private syncChain;
    private reconcileChain;
    private stopped;
    private egressProxyEdgeByProxyId;
    private activeEgressProxiesByEdge;
    private egressFailureCooldownUntil;
    private onTopologyChanged?;
    constructor(manager: RemoteIngressManager, config?: ITunnelManagerConfig);
    setOnTopologyChanged(callback: (reason: string) => void): void;
    /**
     * Start the tunnel hub and load allowed edges.
     */
    start(): Promise<void>;
    /**
     * Stop the tunnel hub.
     */
    stop(): Promise<void>;
    /**
     * Reconcile TS-side edge statuses with the authoritative Rust hub status.
     * Overwrites event-derived activeTunnels with the real activeStreams count.
     */
    private reconcile;
    /**
     * Sync allowed edges from the manager to the hub.
     * Call this after creating/deleting/updating edges.
     */
    syncAllowedEdges(): Promise<void>;
    startEgressTcpProxy(request: TRemoteIngressEgressProxyRequest): Promise<plugins.remoteingress.IEgressTcpProxyInfo>;
    /** Authoritative hub state used by the source-bound mail identity adapter. */
    getAuthoritativeHubStatus(): Promise<TRemoteIngressHubStatus | undefined>;
    /**
     * Eligibility (connected + egressEnabled + egressTcpV1 + native QUIC), scoped by
     * edgeId/edgeFilter, capped by per-edge maxConcurrentStreams, ordered deterministically:
     * not-in-cooldown first, then fewest active tunnels, then edgeId.
     */
    private selectEgressCandidates;
    private describeEgressScope;
    /**
     * Readiness of the outbound egress path for a given edge scope —
     * consumed by the ops API and the email-setup preflight.
     */
    getEgressReadiness(edgeFilter: string[]): IEmailOutboundEgressStatus;
    /**
     * Delegate source-bound connection evidence to the owned RemoteIngress hub.
     */
    waitForEgressConnectionEvidence(proxyId: string, edgeId: string, timeoutMs?: number): Promise<plugins.remoteingress.IRemoteIngressHubEgressConnectionEvent | null>;
    stopEgressTcpProxy(proxyId: string): Promise<boolean>;
    private applyRustStatus;
    private getTopologySignature;
    /**
     * Get runtime statuses for all known edges.
     */
    getEdgeStatuses(): IRemoteIngressStatus[];
    /**
     * Get status for a specific edge.
     */
    getEdgeStatus(edgeId: string): IRemoteIngressStatus | undefined;
    /**
     * Get the count of connected edges.
     */
    getConnectedCount(): number;
    /**
     * Get the public IPs of all connected edges.
     */
    getConnectedEdgeIps(): string[];
    /**
     * Get the total number of active tunnels across all edges.
     */
    getTotalActiveTunnels(): number;
}