import * as plugins from '../plugins.js';
import type { ISecurityCompiledPolicy } from '../../dist_ts_interfaces/data/security-policy.js';
import type { DcRouter } from '../classes.dcrouter.js';
/**
 * Pure route-policy transformations applied before routes reach SmartProxy:
 * route-level trusted ingress authorization, listener-level inbound PROXY
 * protocol policy, and merging of compiled security policies.
 */
export declare class RoutePolicyAugmenter {
    private dcRouterRef;
    constructor(dcRouterRef: DcRouter);
    /**
     * Compile each dcrouter ingress policy into SmartProxy route security, then
     * derive one compatible PROXY protocol mode for every shared listener.
     *
     * The listener mode only controls parsing. Route security remains the
     * authorization boundary, so a direct request cannot fall through to a
     * wildcard route that only permits RemoteIngress or SmartVPN.
     */
    applyInboundProxyProtocolPolicies(routes: plugins.smartproxy.IRouteConfig[]): plugins.smartproxy.IRouteConfig[];
    /** Union blocked IPs/CIDRs across configured and compiled security policies. */
    mergeSecurityPolicies(...policies: Array<Partial<ISecurityCompiledPolicy> | undefined>): ISecurityCompiledPolicy | undefined;
    private getAllowedIngressOrigins;
    private getListenerProxyProtocolPolicy;
    private getInboundProxyListenerKeys;
}