import type { TVpnClientAllowEntry } from '../config/classes.route-config-manager.js';
import type { IDcRouterRouteConfig } from '../../dist_ts_interfaces/data/remoteingress.js';
import type { DcRouter } from '../classes.dcrouter.js';
/**
 * Resolves which VPN clients may access which routes and which IPs belong in
 * a client's WireGuard AllowedIPs, including cached DNS resolution of
 * VPN-gated route domains.
 */
export declare class VpnAccessResolver {
    private dcRouterRef;
    /** Cache for DNS-resolved IPs of VPN-gated domains. TTL: 5 minutes. */
    private domainIpCache;
    /** Deduplicate wildcard-resolution warnings for WireGuard AllowedIPs generation. */
    private warnedWildcardDomains;
    constructor(dcRouterRef: DcRouter);
    /** Clear DNS and warning caches, e.g. after a VPN config change. */
    reset(): void;
    /**
     * Build the per-route VPN client allow resolver handed to RouteConfigManager,
     * or undefined when VPN is disabled.
     */
    createRouteAllowResolver(): ((route: IDcRouterRouteConfig, routeId?: string) => TVpnClientAllowEntry[]) | undefined;
    /**
     * Compute the WireGuard AllowedIPs for a client from its target profiles:
     * the VPN subnet, direct target IPs, and DNS-resolved route domains.
     */
    getClientAllowedIPs(targetProfileIds: string[]): Promise<string[]>;
    /**
     * Resolve a domain's A record(s) for VPN AllowedIPs, with a 5-minute cache.
     */
    private resolveDomainIPs;
    private isWildcardDomain;
    private logSkippedWildcardAllowedIp;
}