import type { IIpIntelligenceRecord, ISecurityBlockRule, ISecurityCompiledPolicy, ISecurityPolicyAuditEvent, TSecurityBlockRuleMatchMode, TSecurityBlockRuleType } from '../../dist_ts_interfaces/data/security-policy.js';
export interface ISecurityPolicyManagerOptions {
    intelligenceRefreshMs?: number;
    retentionSweepIntervalMs?: number;
    now?: () => number;
    onPolicyChanged?: () => void | Promise<void>;
}
export interface IRemoteIngressFirewallSnapshot {
    blockedIps: string[];
}
export declare const IP_INTELLIGENCE_LIST_LIMIT = 500;
export declare const IP_INTELLIGENCE_RETENTION_MAX_AGE_MS: number;
export declare const IP_INTELLIGENCE_RETENTION_HIGH_WATER = 10000;
export declare const IP_INTELLIGENCE_RETENTION_LOW_WATER = 9000;
export declare const IP_INTELLIGENCE_RETENTION_BATCH_SIZE = 500;
export declare const IP_INTELLIGENCE_RETENTION_SWEEP_INTERVAL_MS: number;
export declare class SecurityPolicyManager {
    private readonly smartNetwork;
    private readonly intelligenceRefreshMs;
    private readonly retentionSweepIntervalMs;
    private readonly now;
    private retentionSweepTimer?;
    private retentionSweepPromise?;
    private retentionMutationTail;
    private persistedIntelligenceCount?;
    private readonly inFlightObservations;
    private readonly queuedObservations;
    private readonly observationQueue;
    private readonly lastQueuedAt;
    private activeQueuedObservations;
    private queueDrainScheduled;
    private isStopping;
    private readonly onPolicyChanged?;
    constructor(options?: ISecurityPolicyManagerOptions);
    start(): Promise<void>;
    stop(): Promise<void>;
    observeIps(ips: string[]): Promise<void>;
    queueObservedIps(ips: string[]): void;
    observeIp(ipAddress: string, options?: {
        force?: boolean;
    }): Promise<void>;
    private performObserveIp;
    listBlockRules(): Promise<ISecurityBlockRule[]>;
    listIpIntelligence(options?: {
        ipAddresses?: string[];
        limit?: number;
    }): Promise<IIpIntelligenceRecord[]>;
    private persistNewIntelligence;
    private requestRetentionSweep;
    private pruneIpIntelligence;
    private withRetentionMutation;
    refreshIpIntelligence(ipAddress: string): Promise<IIpIntelligenceRecord | null>;
    private scheduleQueueDrain;
    private drainObservationQueue;
    private pruneQueuedIpMemory;
    listAuditEvents(limit?: number): Promise<ISecurityPolicyAuditEvent[]>;
    private intelligenceFromDoc;
    createBlockRule(input: {
        type: TSecurityBlockRuleType;
        value: string;
        matchMode?: TSecurityBlockRuleMatchMode;
        reason?: string;
        enabled?: boolean;
    }, actor?: string): Promise<ISecurityBlockRule>;
    updateBlockRule(id: string, patch: Partial<Pick<ISecurityBlockRule, 'value' | 'matchMode' | 'reason' | 'enabled'>>, actor?: string): Promise<ISecurityBlockRule | null>;
    deleteBlockRule(id: string, actor?: string): Promise<boolean>;
    compilePolicy(): Promise<ISecurityCompiledPolicy>;
    private compiledPolicyFromSets;
    private getReactiveRuleQuery;
    compileSmartProxyPolicy(): Promise<ISecurityCompiledPolicy>;
    compileRemoteIngressFirewall(): Promise<IRemoteIngressFirewallSnapshot>;
    private matchesAnyReactiveRule;
    private ruleMatchesIntelligence;
    private normalizeIp;
    private normalizeCidr;
    private normalizeNetworkEntries;
    private normalizeNetworkEntryList;
    private ipv4RangeToCidrs;
    private ipv4ToBigInt;
    private numberToIpv4;
    private powerOfTwoExponent;
    private isPublicIp;
    private ruleFromDoc;
    private writeAudit;
    private notifyPolicyChanged;
}